Do I need Microsoft Outlook installed to use this skill?

No, this skill utilizes open-source libraries and command-line tools to parse the binary files directly, making it ideal for Linux-based forensic workstations.

Is this skill suitable for large PST archives?

Yes, the provided analysis patterns are designed to handle modern PST files which can grow up to 50GB, though processing time will vary based on file size and hardware.

What file formats does this skill support?

It supports Microsoft Outlook PST (Personal Storage Table) and OST (Offline Storage Table) files in both modern Unicode and legacy ANSI formats.

Can it recover deleted emails?

Yes, the skill uses libpff and forensic Python scripts to access the Recoverable Items folder and extract messages that have been marked for deletion but not yet overwritten.

What metadata can be extracted from email headers?

It extracts critical forensic data including the Received routing chain, X-Originating-IP, Message-ID, and authentication results such as SPF, DKIM, and DMARC.

Outlook PST Email Forensics

Name: Outlook PST Email Forensics
Author: mukul975

bymukul975

•

4,121

•

Security & Testing

Analyzes Microsoft Outlook PST and OST files to extract forensic evidence, including headers, attachments, and deleted messages.

This skill provides comprehensive capabilities for digital forensics and incident response (DFIR) specifically targeting Microsoft Outlook storage files. By leveraging tools like libpff and custom Python analysis scripts, it enables investigators to reconstruct communication timelines, analyze transport headers for routing anomalies, recover deleted items from MAPI properties, and safely export attachments. It is designed to assist SOC analysts and forensic investigators in legal investigations or security breach assessments involving email exfiltration, phishing, or unauthorized data movement.

Key Features

01Bulk attachment extraction and metadata logging for malware identification

02Recovery of deleted items from the MAPI Recoverable Items folder

03Detailed forensic report generation in JSON format for automated ingestion

04Automated extraction of email headers for routing and IP analysis

05Deep parsing of PST and OST binary formats using libpff and pffexport

064,121 GitHub stars

Use Cases

01Tracing the origin of phishing campaigns by analyzing X-Originating-IP and transport headers

02Recovering evidence from deleted emails during internal security audits or legal discovery

03Investigating corporate data exfiltration via archived email folders

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills analyzing-outlook-pst-for-email-forensics

For use in Claude.ai and ChatGPT

Key Features

01Bulk attachment extraction and metadata logging for malware identification

02Recovery of deleted items from the MAPI Recoverable Items folder

03Detailed forensic report generation in JSON format for automated ingestion

04Automated extraction of email headers for routing and IP analysis

05Deep parsing of PST and OST binary formats using libpff and pffexport

064,121 GitHub stars

Use Cases

01Tracing the origin of phishing campaigns by analyzing X-Originating-IP and transport headers

02Recovering evidence from deleted emails during internal security audits or legal discovery

03Investigating corporate data exfiltration via archived email folders

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills analyzing-outlook-pst-for-email-forensics

For use in Claude.ai and ChatGPT