Email messages can be a goldmine of digital evidence both in criminal and corporate investigations. Oxygen Forensic® Detective enables email data extraction from mobile devices, computers, and from the cloud. Overall, utilizing various extraction methods, investigators can extract the following email apps:
- Microsoft Outlook
- Mozilla Thunderbird
- Google Mail
- QQ Mail
Learn more about supported email services in Oxygen Forensic® Detective.
Oxygen Forensic® Detective v.15.1 added support for a new email data source. Now investigators can import and analyze Microsoft Outlook Data Files of .pst and .ost formats.
Type of Microsoft Outlook Data Files
Microsoft Outlook stores a local copy of downloaded and synchronized emails on a user’s computer. POP accounts store their information in Outlook Data Files (.pst files) while Outlook 365 accounts, Exchange accounts, IMAP accounts, and Outlook.com accounts store it in Offline Outlook Data Files (.ost files).
Outlook Data Files (.pst) created by Outlook 2013 or Outlook 2016 are in the Documents\Outlook Files folder. If a user upgraded to Outlook on a computer that already had data files that were created in Microsoft Office Outlook 2007 or earlier, these files are saved in a hidden folder \Users\user\AppData\Local\Microsoft\Outlook. Outlook Data Files contain messages as well as contacts, calendar data, and tasks.
Offline Outlook Data Files (.ost) are located at: drive:\Users\user\AppData\Local\Microsoft\Outlook.
Most data may remain on the server, so investigators will have only synchronized items in an Offline Outlook Data File.
Analysis of Microsoft Outlook Data Files in Oxygen Forensic® Detective
To import Microsoft Outlook Data Files, click the relevant option under “Desktop data” on the software Home screen and follow the instructions of the “Import Wizard”.
Once data is parsed, investigators will be able to analyze it in Oxygen Forensic® Detective.