Anthropic-Cybersecurity-Skills/skills/analyzing-outlook-pst-for-email-forensics/references/workflows.md

Workflows - PST Email Forensics

Workflow: Email Evidence Extraction

Acquire PST/OST files from evidence
    |
Hash original files (SHA-256)
    |
Export with pffexport (items + recovered)
    |
Parse email headers for routing
    |
Extract and hash attachments
    |
Search for keywords across messages
    |
Build communication timeline
    |
Document findings with chain of custody