Anthropic-Cybersecurity-Skills/skills/analyzing-outlook-pst-for-email-forensics/references/standards.md

Standards - Outlook PST Email Forensics

Standards

• MS-PST: Outlook Personal Folders (.pst) File Format
• MS-OXMSG: Outlook Item Message File Format
• NIST SP 800-86: Guide to Integrating Forensic Techniques

Tools

• libpff/pffexport: Open-source PST parser
• pypff (Python): Python bindings for libpff
• MailXaminer: Commercial email forensics
• PST Walker: Email investigation software
• Kernel Outlook PST Viewer: Free PST reader

Key Artifacts

• Email headers (Received, X-Originating-IP, Message-ID)
• Deleted items (Recoverable Items folder)
• Attachments (malware, exfiltrated data)
• Calendar events, contacts, tasks