mail (PST/MSG) head...
 
Notifications
Clear all

mail (PST/MSG) header extraction for statistical analysis

8 Posts
6 Users
0 Reactions
515 Views
jhup
 jhup
(@jhup)
Noble Member
Joined: 16 years ago
Posts: 1442
Topic starter  

Any of you have a tool/method/process/reference/idea on extracting header information from large quantities of e-mail messages for statistical analysis?

I need to extract at least from, to, subject, date/time sent, and if possible the MUID.

Any suggestion is appreciated.

p.s I found some info, but it seems this is only for people who no little to nothing about forensics. It is through Computer Forensics Analysis & Training Center, Inc, an intro of sorts to forensics…


   
Quote
CFEx
 CFEx
(@cfex)
Trusted Member
Joined: 16 years ago
Posts: 69
 

If you mean "extracting from MS Outlook", try MS Access.

2003 & 2007 have a feature to import MAPI folders into an Access table. The caveat is that it needs to be a "mail folder" in Outlook.


   
ReplyQuote
jhup
 jhup
(@jhup)
Noble Member
Joined: 16 years ago
Posts: 1442
Topic starter  

No, I would prefer not to use Outlook. the volume makes Outlook choke through MAPI, and as you described it - single folder at a time…

I have been looking for C, Perl, Phython, or pretty much anything construct of the PST format. I am not up to write it myself from the MS pages…


   
ReplyQuote
harryparsonage
(@harryparsonage)
Estimable Member
Joined: 20 years ago
Posts: 184
 

Have a look at this, not sure but it might be of help.

http//sourceforge.net/projects/libpff/

H


   
ReplyQuote
(@c-r-s)
Estimable Member
Joined: 14 years ago
Posts: 170
 

I'm using TextPipe. But at ~100k mails it can be quite complicated to create a rule set that extracts the fields from every single message correctly and suitable for pattern recognition.


   
ReplyQuote
(@kovar)
Prominent Member
Joined: 18 years ago
Posts: 805
 

Greetings,

Microsoft opened up their PST spec. I've been toying with implementing tools in Python for "doing things" with PST files based on that spec but it isn't a small project so I've not dived into it yet.

-David


   
ReplyQuote
jhup
 jhup
(@jhup)
Noble Member
Joined: 16 years ago
Posts: 1442
Topic starter  

Thanks all.

I think TextPipe would not be of value to extract from PST/MSG as they are "binary". On the other hand, if I convert the PST to mbox or something similar, it maybe a handy tool.

Arrgh! I was hoping something other than code writing will be available. Thanks Harry.

David, I have looked at the docs, and that is what I was planning to do - except I do not have time, nor the resources to read through the documentation.


   
ReplyQuote
(@d_gates)
New Member
Joined: 14 years ago
Posts: 2
 

I'm not sure whether this eill help, but try PST Walker, it could help you with your problem. It has a trial period so you don't have to pay for it if you're gonna use it just once.


   
ReplyQuote
Share: