Microsoft Outlook is an email application that provides personal information management, task managing, contact managing, email client, calendaring, note-taking, and web browsing. Microsoft Outlook was developed by Microsoft Corporation. Outlook is available for desktop (Windows and macOS) and mobile devices (Android, iOS, and Windows).
Mailboxes make an essential part of our lives since it is considered one of the most important methods of communication in the 21st century. In accordance, the forensics of mailboxes is a crucial part of digital forensics. Forensic searches are carried out to investigate and find any leads of a felony or wrong acts which helps in solving a case or problem.
Microsoft Outlook stores email artifacts at the following locations:
Outlook consists of two data storage folders, the Personal Storage File (PST) and the Offline Outlook Data File (OST). The Personal Storage Table also known as Outlook Data File has the capability of storing all email data as a record in a compact format and is in the user’s local disk, while the OST files save data for offline use. Both files can be converted for the other when needed. Generally, email artifacts always exist in Outlook PST file such as email messages data and attachments.
This section discusses how to use ArtiFast to extract Outlook artifacts from Windows machines and
what kind of digital forensics insight we can gain from the platform.
After you have created your case and added evidence for the investigation, at the Artifacts Parser Selection Phase, you can select Outlook Artifacts:
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View”, with indexing, filtering, and searching capabilities. Below is a detailed description of the Outlook artifacts in ArtiFast Windows.
This artifact contains information of the Offline Outlook Data File (*.ost) and Personal Storage File (*.pst) for older versions of Microsoft Outlook. The details you can view include:
Outlook PST/OST Artifact
This artifact contains information of the Offline Outlook Data File (*.ost) and Personal Storage File (*.pst). The details you can view include:
Outlook MSG Artifact
This artifact contains the .msg file information that is intended for single message objects, such as an email, an appointment, a contact, and a task. The details you can view include: