Recommendations for PST Tools?
The private firm I work for has asked me to find and research new tools that deal with Outlook PST files. We have paraben's email examiner and are not happy with its flakiness and the lack of features that we are looking for. We need something that can open open multiple PST's, bulk export of "bookmarked" messages and most importantly, the ability to search the PST's for specific keywords and/or phrases. In fact, may I ask that some of our more experienced and battle-hardened forensic experts to recomment great PST forensic tools?
I work with PST/NSF everyday.
Have you tried DT Search or OutIndex, both are pretty descent tools.
awesome, someone just recommended OutIndex and isn't DT Search built into FTK? I've contacted OutIndex about their pricing just awhile ago, so I'm curious as to how much you paid for it?
Thank you for responding D
i just got the quote … so I consulted two of my old college buddies and we all agreed that the amount they want is slightly more than what it would cost to fund our own open source project that does the exact same thing -|
I bit too pricy for my blood.
It is a pricey software as are most programs in this field.
Here is the catch for doing inhouse development, it has to be proven in court especially for kw searches, so it might be cheaper still to go with it.
We can talk more about this privately at some time.
How about using Outlook with .pst files. It works a treat for me every time 😉
Seriously…. the easy way to examine an Outlook .pst file is to import it into Outlook, after all this is how the author/user/owner of the .pst file viewed it. Often with Forensic Computing, the best practice is to use the original software to view its associated files. IMHO Microsoft Office is an essential program/software suite for any FC practitioner (well those using a Windows platform….). It will handle mulitple .pst files, and bulk export msg, txt, and html formats, just as your specifications dictate.
It's also possible to carve .pst file(s) from unallocated clusters and again import these into Outlook.