Converting PST Archives In OS X/Linux With libpst

Some time ago I gave an introduction to converting Microsoft MSG files to a readable RFC 2822 format on Linux. In fact you will sometimes get an even kinkier format to work with: The Outlook Data File (PST). PST files is a proprietary format used by Microsoft Outlook, and is the equivalent of the mbox on Linux.

Edit August 29th: Also have a look at the more up-to-date libpff.

Even though PST files are a bit harder than single EML files, there is hope if you only have a Linux client: [libpst, and more specifically readpst. For libpst you need three libraries:

libgsf (i/o library that can read and write common file types and handle structured formats that provide file-system-in-a-file semantics)

  • boost (portable C++ source libraries)
  • libpst

On OS X you can install it by:

brew install libgsf
brew install boost
brew install libpst

Now if you have a pst archive, like this one for instance, you can convert it by:

mkdir export
readpst -M -b -e -o export "Personal Folders.pst"

This should give an output like this:

Opening PST file and indexes...
Processing Folder "Deleted Items"
Processing Folder "Inbox"
Processing Folder "latest"
[...]
Processing Folder "Reports"
    "Reports" - 11 items done, 1 items skipped.
Processing Folder "Quotes"
    "Quotes" - 1 items done, 1 items skipped.
Processing Folder "Printer"
    "Printer" - 1 items done, 1 items skipped.
Processing Folder "Passwords"
    "Passwords" - 6 items done, 1 items skipped.
[...]
Processing Folder "Kum Team"
    "Kum Team" - 37 items done, 0 items skipped.
    "9NT1425(India 11.0)" - 228 items done, 1 items skipped.
Processing Folder "Jimmi"
    "Jimmi" - 31 items done, 0 items skipped.
    "Inbox" - 27 items done, 11 items skipped.
Processing Folder "Outbox"
Processing Folder "Sent Items"
    "Sent Items" - 0 items done, 1 items skipped.
Processing Folder "Calendar"
    "Calendar" - 0 items done, 6 items skipped.
Processing Folder "Contacts"
    "Contacts" - 0 items done, 1 items skipped.
[...]
Processing Folder "Drafts"
Processing Folder "RSS Feeds"
Processing Folder "Junk E-mail"
Processing Folder "quarantine"
    "My Personal Folder" - 13 items done, 0 items skipped.

Which creates a directory structure like ls -l 'export/My Personal Folder':

drwxr-xr-x   2 -  staff   68 Aug 28 21:34 Calendar
drwxr-xr-x   2 -  staff   68 Aug 28 21:34 Contacts
drwxr-xr-x  29 -  staff  986 Aug 28 21:34 Inbox
drwxr-xr-x   2 -  staff   68 Aug 28 21:34 Journal
drwxr-xr-x   2 -  staff   68 Aug 28 21:34 Sent Items
drwxr-xr-x   2 -  staff   68 Aug 28 21:34 Tasks

If you sample Inbox/Mails/, you will find:

1.eml    10.eml  11.eml  12.eml  13.eml  14.eml  15.eml  16.eml  17.eml  2.eml   3.eml   4.eml   5.eml   6.eml   7.eml   8.eml   9.eml

You can now continue with our previous post Reading MSG and EML Files on OSX/Linux Command Line. I'll also encourage you to have a look at the documentation of the outlook.pst format.

Tommy

Tommy is an analyst and incident handler with more than seven years of experience from the government and private industry. He holds an M.Sc. in Digital Forensics and a B.Tech. in information security