Join Us!

Notifications
Clear all

Parsing PSTs  

  RSS
keydet89
(@keydet89)
Community Legend

All,

I've got a couple of PST files created by using ExMerge on an Exchange server. I'm looking for a tool that will allow me to list the attachments, by file name, within folders.

I know that EnCase, Paraben and FTK will let you open PST files. I have EnCase, but not the other two.

I'm looking for a solution that I can use in the future, and distribute to the team…anything freely available is good, but what I'd like to get is input on the tools that have worked, not just what's out there. "Outlook Express Archiver" from WheresJames Software was recommended to me, but the person recommending it never bothered to check if it was still available. ;-(

thanks,

Harlan

Quote
Posted : 23/02/2007 9:45 pm
andy1500mac
(@andy1500mac)
Member

Harlan,

If I understand you correctly Encase can pretty much do what you are asking. I'm using v6.2 and just dragged a PST into the case window and then mounted by "Viewing file structure".

I then sorted by file extension or alternately description (attachment). Then checked all the docs, xls, etc and exported the list (selecting name and full path as export fields)

Is this what you are looking for..?

Andrew

ReplyQuote
Posted : 23/02/2007 10:26 pm
keydet89
(@keydet89)
Community Legend

Andrew,

Thanks. That is what I'm looking for, albeit I only have EnCase 5.05f.

I'm also looking for other alternatives, such as freeware apps (if possible) as alternatives. However, I do thank you for your response…it's greatly appreciated.

Harlan

ReplyQuote
Posted : 23/02/2007 11:30 pm
BraneRift
(@branerift)
Member

I am not familiar with Exchange, but I am guessing the PST are the same with Outlook?

Before my department would come off money and but FTK and EnCase, I had a VM running with Outlook and just imported the PST ) It was free and rather easy. I know you are looking for a freeware tool, but I am not aware of any. I tend to use FTK for email. I think it organizes better than Encase (5.05f).

ReplyQuote
Posted : 26/02/2007 8:40 pm
keydet89
(@keydet89)
Community Legend

BraneRift,

Thanks for the response.

> Before my department would come off money and but FTK and EnCase,

What???

Also, I am not simply looking to open these PSTs with a freeware tool. Again, in my original post, I am looking for a way to list the names of the files that are attached to the emails, particularly those in the Sent folder. I am aware that Outlook and Outlook Express can open the emails, but then I'd have to go through by hand, and with the number of emails I'm looking at may end up missing some attachments.

Again, I am not looking for the content of the emails…I am looking to get just the names of the attachments.

Thanks,

Harlan

ReplyQuote
Posted : 26/02/2007 9:29 pm
BraneRift
(@branerift)
Member

Harlan,

In my opinion, I think FTK does the superior job of listing only the attachments to the emails (path, times, etc). I will include a screenshot so you may see then end result, but I have to wait till I return home inorder to post the graphic on a server. This will give you a better idea of all the imformation that is included on the FTK email screen.

> Before my department would come off money and but FTK and EnCase,

What???

My mind works faster than my fingers or something is lost in the translation of brain activity and motor skills….. What it was supposed to say is "Before my department would come off the money for FTK and Encase"

Kevin

ReplyQuote
Posted : 27/02/2007 1:29 am
gmarshall139
(@gmarshall139)
Active Member

Harlan,

You can isolate attachments in version 5 very easily. Mount the .pst file(s), homeplate everything, and create a condition for "description=Attachment".

ReplyQuote
Posted : 28/02/2007 12:31 am
Thomas
(@thomas)
Junior Member

Hello,

you can also try "Outlook Attachment Sniffer". This tool moves or copies all the attachment to a directory of your choice. This did the job for me! Its not freeware, but 15 dollars is not expensive. I think you should try the demo at http//www.rsbr.de/Software/OASniffer/index_eng.htm
Good luck!

ReplyQuote
Posted : 01/03/2007 11:22 pm
keydet89
(@keydet89)
Community Legend

All,

Thanks for your advice. I accomplished what I needed with FTK 1.7 and a Perl script.

Thanks again,

Harlan

ReplyQuote
Posted : 02/03/2007 5:00 am
BraneRift
(@branerift)
Member

Harlan,

Sorry I didn't get to post those pictures. I had to have a double hernia surgery. Ouchie

I am glad that FTK worked out for you.

ReplyQuote
Posted : 06/03/2007 4:46 am
brunty11
(@brunty11)
New Member

Using EnCase select (assuming e-mails have been swept)

View>Cases>E-mail, then click on attachments.

to bookmark a single highlighted file attachment, right-click, then select bookmark files, to isolate these files where you want them.

To bookmark multiple file attachments within one of several e-mail messages, first ensure no individual files are selected. Right-click on the attachment and select tag file. Each time an attachment is tagged, the dixon box (top-right of the view pane - tells total #of files checked) reflects an additional blue-checked file in cases>entries>home. To bookmark all tagged files, right-click, then select bookmark files.

Hope this helps!

ReplyQuote
Posted : 06/03/2007 8:14 pm
keydet89
(@keydet89)
Community Legend

Brunty,

Thanks for the input, and don't take this the wrong way (because I do appreciate your effort and time), it doesn't help. Following your process doesn't get me where I needed to be, based on the info I provided in the thread.

However, again, I do thank you for your efforts.

H

ReplyQuote
Posted : 06/03/2007 9:00 pm
cinux
(@cinux)
New Member

Harlan,
Did you try mail navigator available at www.mailnavigator.com.
It worked pretty well for me in some cases.
Regards,
Chetan

ReplyQuote
Posted : 30/03/2007 2:05 am
keydet89
(@keydet89)
Community Legend

Cinux,

No, I didn't…had no idea it existed.

Thanks, though.

H

ReplyQuote
Posted : 30/03/2007 4:20 am
Share: