Re: [sleuthkit-users] Parse outlook pst file to locate emails by sentor crated date range

[ajs <ant...@gm...>]

Thanks. I don't recall if i added it as a data source specifically in my case but it never pulled anything for me. I'll try again to see what I can get.

-----Original Message-----
From: "Jason Letourneau" <jle...@ba...>
Sent: ‎9/‎22/‎2014 7:17 PM
To: "Joyce Nord" <joy...@gm...>
Cc: "ajs" <ant...@gm...>; "sle...@li..." <sle...@li...>
Subject: Re: [sleuthkit-users] Parse outlook pst file to locate emails by sentor crated date range

Libpst is integrated into Autopsy 3.1 so you should be able to add the PST file as a data source (logical file) and get it parsed as long as you enable the email parser ingest module - there are some limitations with Libpst in terms of file and version support, so you may need to see if your file is in their supported version set 


Jason

On Monday, September 22, 2014, Joyce Nord <joy...@gm...> wrote:

Thank you. 
 
Trying to do it with open source right now to prove it can be done.  Looks like my options are readpst and then grepmail or even perhaps regular grep and scripting moving the files matching the attribute pattern.
 
grepmail looks like it might work but I keep getting the error "invalid config variable: todayismidnight
 
Which was supposedly rectified back in 2010 or 11, but apparently not.
 
*****************************************************************************************************************************************************************************************************
 
In accordance with applicable privacy protection laws, this email and its contents are a private communication and are intended only for the expressed recipient.  I do not authorize disclosure to a third party without my direct written consent. 
If you have received this email in error or are not the intended recipient, securely destroy it (as well as all copies) and notify me via separate email immediately. 
 
******************************************************************************************************************************************************************************************************
 
From: ajs [mailto:ant...@gm...] 
Sent: Monday, September 22, 2014 6:30 PM
To: Joyce Nord; sle...@li...
Subject: RE: [sleuthkit-users] Parse outlook pst file to locate emails by sent orcrated date range
 
In my limited experience, no. I asked about this a week or two ago and didn't hear anything back. If you have IEF or FTK, both if those handle it well.



From: Joyce Nord
Sent: ‎9/‎22/‎2014 6:07 PM
To: sle...@li...
Subject: [sleuthkit-users] Parse outlook pst file to locate emails by sent orcrated date range
Is there a way to do this within Autopsy 3.0?  I have a PST I need to parse, not an entire image. 
 
*****************************************************************************************************************************************************************************************************
 
In accordance with applicable privacy protection laws, this email and its contents are a private communication and are intended only for the expressed recipient.  I do not authorize disclosure to a third party without my direct written consent. 
If you have received this email in error or are not the intended recipient, securely destroy it (as well as all copies) and notify me via separate email immediately. 
 
******************************************************************************************************************************************************************************************************