Microsoft Release pst file format

OK I still have the newbie tag so I guess I can ask a "stupid" question.

Since all of the tools parse the *pst file already, what does this get us in the end? Is it that we are only parsing what we (not me, the smart guys) can figure out?
Is there more information that can be gathered with the specifications?

Well up until now, the parsing tools and techniques have been based on educated guesses based on inspection of the data. Now that the spec has been released, it's no longer a guess. This improves the reliability of any forensic evidence gleaned from a PST.

Is there more information that can be gathered with the specifications?

Most of the software that extracts data from PSTs uses Microsoft's MAPI which means that you are not dealing directly with the raw data (and that you have to have Outlook installed to use them). Those that do not, as Tony has suggested, are based upon reverse engineering and educated guesses (as well as a lot of hard work). Add to that the risk that MS will change the underlying format and not MAPI and you have a less than ideal situation.

I would expect that this would make it easier to support such things as the excellent libpst and lower the cost of software to manipulate PSTs for forensic purposes.

Also, think of it that the more open the architecture the more effective we as examiners can be when dealing with proprietary files.

Should we start a betting pool as to which company updates their software to the spec first? )

Tom

Also consider the occasions, rare as they may be, where you need to manually recover or verify partial records which automated tools don't pick up.

Being able to say in court that you were working from the developers documentation will hold more weight than saying it was inferred from reverse engineering.

I'm currently facing this issue with a file format where I can show from basic testing that the reverse engineered "standard" is actually incorrect ( I'd kill (or at least commit assault) to get my hands on the manufacturer's doco!

Cheers,
Chris

From the data recovery side, any spec is always a bonus.

Is there a library of similar documentation within the forum?

From the data recovery side, any spec is always a bonus.

Is there a library of similar documentation within the forum?

Not in the forum but Microsoft have been releasing lots of their specifications like the pst for some while now -

http//msdn.microsoft.com/en-us/library/dd208104%28PROT.10%29.aspx

H