±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 2 Overall: 36764
New Yesterday: 9 Visitors: 198

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Parsing PSTs

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2 
  

Thomas
Member
 

Re: Parsing PSTs

Post Posted: Mar 02, 07 00:22

Hello,

you can also try "Outlook Attachment Sniffer". This tool moves or copies all the attachment to a directory of your choice. This did the job for me! Its not freeware, but 15 dollars is not expensive. I think you should try the demo at www.rsbr.de/Software/O...ex_eng.htm
Good luck!
_________________
ICT Security Manager, CHFI, CEH, ECSA, Netherlands 
 
  

keydet89
Senior Member
 

Re: Parsing PSTs

Post Posted: Mar 02, 07 06:00

All,

Thanks for your advice. I accomplished what I needed with FTK 1.7 and a Perl script.

Thanks again,

Harlan  
 
  

BraneRift
Senior Member
 

Re: Parsing PSTs

Post Posted: Mar 06, 07 05:46

Harlan,

Sorry I didn't get to post those pictures. I had to have a double hernia surgery. Ouchie

I am glad that FTK worked out for you.  
 
  

brunty11
Member
 

Re: Parsing PSTs

Post Posted: Mar 06, 07 21:14

Using EnCase select (assuming e-mails have been swept):

View>Cases>E-mail, then click on attachments.

to bookmark a single highlighted file attachment, right-click, then select bookmark files, to isolate these files where you want them.

To bookmark multiple file attachments within one of several e-mail messages, first ensure no individual files are selected. Right-click on the attachment and select tag file. Each time an attachment is tagged, the dixon box (top-right of the view pane - tells total #of files checked) reflects an additional blue-checked file in cases>entries>home. To bookmark all tagged files, right-click, then select bookmark files.

Hope this helps!  
 
  

keydet89
Senior Member
 

Re: Parsing PSTs

Post Posted: Mar 06, 07 22:00

Brunty,

Thanks for the input, and don't take this the wrong way (because I do appreciate your effort and time), it doesn't help. Following your process doesn't get me where I needed to be, based on the info I provided in the thread.

However, again, I do thank you for your efforts.

H  
 
  

cinux
Member
 

Re: Parsing PSTs

Post Posted: Mar 30, 07 01:05

Harlan,
Did you try mail navigator available at www.mailnavigator.com.
It worked pretty well for me in some cases.
Regards,
Chetan
_________________
Chetan Gupta
ENCE, GCFA, GCIA, CEH, CCNA, CIW Sec. Analyst
Forensic Analyst 
 
  

keydet89
Senior Member
 

Re: Parsing PSTs

Post Posted: Mar 30, 07 03:20

Cinux,

No, I didn't...had no idea it existed.

Thanks, though.

H  
 

Page 2 of 2
Page Previous  1, 2