thoughts/data/converting-pst.md

Some time ago I gave an introduction to converting Microsoft MSG files [1] to a readable RFC 2822 [2] format on Linux. In fact you will sometimes get an even kinkier format to work with: The Outlook Data File (PST) [3]. PST files is a proprietary format used by Microsoft Outlook, and is the equivalent of the mbox on Linux.

Edit August 29th: Also have a look at the more up-to-date [4].

Even though PST files are a bit harder to read than single EML files, there is hope if you only have a Linux client: libpst, and more specifically readpst. For libpst you need three libraries:

• libgsf (i/o library that can read and write common file types and handle structured formats that provide file-system-in-a-file semantics)
• boost (portable C++ source libraries)
• libpst

On OS X you can install it by:

brew install libgsf
brew install boost
brew install libpst

Now if you have a pst archive, like [5] for instance, you can convert it by:

mkdir export
readpst -M -b -e -o export "Personal Folders.pst"

This should give an output like this:

Opening PST file and indexes...
Processing Folder "Deleted Items"
Processing Folder "Inbox"
Processing Folder "latest"
[...]
Processing Folder "Reports"
	"Reports" - 11 items done, 1 items skipped.
Processing Folder "Quotes"
	"Quotes" - 1 items done, 1 items skipped.
Processing Folder "Printer"
	"Printer" - 1 items done, 1 items skipped.
Processing Folder "Passwords"
	"Passwords" - 6 items done, 1 items skipped.
[...]
Processing Folder "Kum Team"
	"Kum Team" - 37 items done, 0 items skipped.
	"9NT1425(India 11.0)" - 228 items done, 1 items skipped.
Processing Folder "Jimmi"
	"Jimmi" - 31 items done, 0 items skipped.
	"Inbox" - 27 items done, 11 items skipped.
Processing Folder "Outbox"
Processing Folder "Sent Items"
	"Sent Items" - 0 items done, 1 items skipped.
Processing Folder "Calendar"
	"Calendar" - 0 items done, 6 items skipped.
Processing Folder "Contacts"
	"Contacts" - 0 items done, 1 items skipped.
[...]
Processing Folder "Drafts"
Processing Folder "RSS Feeds"
Processing Folder "Junk E-mail"
Processing Folder "quarantine"
    "My Personal Folder" - 13 items done, 0 items skipped.

Which creates a directory structure like ls -l 'export/My Personal Folder':

drwxr-xr-x   2 -  staff   68 Aug 28 21:34 Calendar
drwxr-xr-x   2 -  staff   68 Aug 28 21:34 Contacts
drwxr-xr-x  29 -  staff  986 Aug 28 21:34 Inbox
drwxr-xr-x   2 -  staff   68 Aug 28 21:34 Journal
drwxr-xr-x   2 -  staff   68 Aug 28 21:34 Sent Items
drwxr-xr-x   2 -  staff   68 Aug 28 21:34 Tasks

If you sample Inbox/Mails/, you will find:

1.eml	10.eml	11.eml	12.eml	13.eml	14.eml	15.eml	16.eml	17.eml	2.eml	3.eml	4.eml	5.eml	6.eml	7.eml	8.eml	9.eml

You can now continue with our previous post [6]. I'll also encourage you to have a look at the documentation of the Outlook PST format [7].

[1] Converting Microsoft MSG files: /2013-10-08-msg-eml.html
[2] RFC 2822: http://tools.ietf.org/html/rfc2822
[3] The Outlook Data File (PST): http://office.microsoft.com/en-001/outlook-help/introduction-to-outlook-data-files-pst-and-ost-HA010354876.aspx
[4] libpff: /converting-pst-archives-in-os-xlinux-with-libpff
[5] Example PST file: http://sourceforge.net/projects/pstfileup/files/Personal%20Folders.pst/download
[6] Reading MSG and EML Files on OSX/Linux Command Line: :4443/forensics/reading-msg-files-in-linux-command-line/
[7] The outlook.pst format: http://www.five-ten-sg.com/libpst/rn01re05.html