How to Examine PST File in Outlook? Know, What You Have to Do!
I am John and I have been an email forensics investigator since 2016. These days, our end users submit many questions regarding email phishing, spam, spoofing, etc. Yesterday I received a case report regarding Outlook email headers. A not trusted customer sent an anonymous email that needs to be tracked.
A client sent me some PST files for email forensics to find suspicious emails and send them in a portable format. I know about email header analysis, but I’m looking for a better way to investigate email forensics. So, how to examine PST files with or without the Outlook version? Please suggest a reliable solution to get the job done.
Microsoft Outlook is one of the most trusted email clients and is widely used by small to large organizations. Outlook creates a PST file locally to store all Personal Folders data and saves it on the end user’s hard drive partition. When Outlook connects to Microsoft Exchange Server, it creates an OST file that allows users to work in offline mode.
All Outlook email information is saved in the email header. If someone sends an email (with the wrong intention), all important information will be saved in the email header, which will help email forensic examiners track down suspicious emails and senders.
Are you one of those people who encounter a similar example defined in John’s scene? If yes, then you should explore the best solutions in this article to help you get the answer on how to investigate PST files in the Outlook version.
How to Examine PST File in Outlook Manually?
The Microsoft Outlook application provides a built-in option to read the email header of a specific email with full associated information. In Outlook, Internet Headers uses the example of email headers (both serve the same purpose). Outlook does not offer a direct option to open email headers. Outlook users can view email headers in four simple steps that need to be followed carefully.
Follow the below-mentioned steps to examine the PST file in Outlook:
Step-1: Open Microsoft Outlook and Select a required email message
Step-2: Once you selected the required email message then go to File option
Step-3: Under File tab, open Properties option
Step-4: Finally, view the email header of the selected email message on the Internet Headers box.
How to Examine PST File with 8 Preview Mode?
The traditional methods above are only for viewing email headers, but are not helpful in many cases for email forensics investigations in Outlook. Also, if you don’t have Outlook installed on your machine and you only have PST files, how can you open PST files without Outlook?
However, in the situation, you must go with a Free Solution, SysTools PST Viewer. This software is specially designed with forensic features such as viewing orphan, corrupted, password-protected PST files with 8 preview modes. Investigate Microsoft Outlook emails in Normal Mail View, Hex View, Properties View, Message Header View, HTML View, MIME View, RTF View, and Attachments.
Brief Description of the Tool Multiple Preview Modes
Let’s have a look at each preview mode with a brief description:
1. Normal Mail View: It includes Outlook email messages basic details such as subject, sender, receiver, date/time, associated attachments, etc.
2. Message Header View: In this mode, it provides a quick email header analysis of Outlook email message over different mail servers.
3. Hex View: This preview mode let you know the bit-by-bit information of the particular email messages that help to investigate email forensics in Outlook.
4. Properties View: This preview option will allow knowing the number of MUAs/MTAs that the email has traversed, send or receive protocols has used, timestamps, etc.
5. HTML View: This view mode let you know the email message entire HTML code that is available at the back end.
6. RTF View: You can view the plain text of the Outlook email messages in Rich Text Format (RTF) by this preview mode.
7. Attachments: This preview option helps to view different attachment files that associated with the Outlook emails such as PDF, Documents (.doc, .docx, .xls, .xlsx, ppt, pptx, etc), Images (.png, .jpg, .gif, etc).
8. MIME View: This preview option helps you to know the different minor details of the email message such as IP address, server routing, etc.
Let’s Sum Up
In this article, we describe how to examine PST file in Outlook using traditional automation solutions. Sometimes, it can be difficult to view the Outlook email headers of the end user. Since the option is not directly available or visible. Sometimes it is necessary to open the email header of a PST file without the Outlook application installed.
For that, use Free Solution as suggested above to open and investigate the email header of PST files without the required Outlook installation. This software provides 8 preview modes to investigate email forensics in Microsoft Outlook versions. Hope you get the right solution!
