Outlook data files (PST and OST)

What it is

Classic Outlook (Outlook 2003 to Microsoft 365 Apps) stores mail in two Personal Folders formats:

• PST (Personal Storage Table): a standalone archive used for POP/IMAP accounts, exports and user archives. It is portable and can be opened on any machine.
• OST (Offline Storage Table): a local cache of an Exchange or Microsoft 365 mailbox in Cached Exchange Mode. It is bound to the Outlook profile that created it, but forensic parsers read it directly.

Both hold messages, attachments, calendar items, contacts, tasks and folder structure. In phishing and data-leak cases they are the primary source for what the user actually received, opened and forwarded.

Location

PSTs can live anywhere, including removable drives and network shares. The Search\Catalog values and the profile keys often reveal PST paths that no longer exist on disk.

New Outlook for Windows (olk.exe) is a WebView2-based app that does not use an OST. Its local cache sits under %LOCALAPPDATA%\Microsoft\Olk\, reportedly as Chromium-style storage (IndexedDB, cache). Treat that layout as version-dependent and verify on a reference machine.

What it proves

• Proves a message was present in the mailbox, with its sender, recipients, subject, body, headers and attachments.
• Proves user handling: read flag, reply/forward state, the folder it sits in (including Deleted Items), and when the item was last modified.
• A file in Content.Outlook proves the attachment was opened (or previewed with an external handler) from Outlook on this machine.
• It does not prove a message was read by a human: preview pane, rules and mobile clients all change the read flag.
• An OST is a cache: an item missing from it may still exist server-side (Recoverable Items, litigation hold). Request a server-side export when possible.

Key fields

Timestamps

Retention and clearing

• A PST persists until the user deletes the file. Items deleted from Deleted Items leave the folder tree but blocks often survive inside the PST until it is compacted; pffexport can recover some of them.
• An OST only holds the "mail to keep offline" window. In recent builds the default depends on disk size (commonly between one month and one year), so older mail may exist only on the server.
• Exchange and Microsoft 365 keep hard-deleted items in the server-side Recoverable Items folder for 14 days by default (configurable, longer under hold).
• Content.Outlook files are normally removed when the attachment is closed, but often remain after a crash or when the file was still open when Outlook exited.

Collection

The data files are locked while Outlook runs. Use a triage tool with raw access or a shadow copy.

# KAPE target
kape.exe --tsource C: --tdest E:\case --target OutlookPSTOST
# Locate every PST/OST, and the attachment cache folder name
Get-ChildItem C:\Users -Recurse -Include *.pst,*.ost -ErrorAction SilentlyContinue
reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Security" /v OutlookSecureTempFolder
reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Search\Catalog"

Also collect Content.Outlook, NTUSER.DAT and Downloads.

Parsing tools

• libpff (Joachim Metz, open source): pffinfo and pffexport -m all -f all file.pst export items, attachments and recovered items. Support for the 4 KB page OST variant written by Outlook 2013+ has historically been limited; test on your version.
• XstReader (open source): Windows GUI to browse PST/OST, view headers and export attachments.
• readpst (libpst): PST to mbox/EML on Linux.
• Commercial: Aid4Mail, Forensic Email Collector, Magnet AXIOM, X-Ways, Intella and Nuix handle PST/OST at scale with search and deduplication.

Investigation tips

• Phishing workflow: find the lure by subject or sender, pull the headers (Received chain, SPF/DKIM/DMARC, Message-ID), export the attachment and hash it, then look for the same filename in Content.Outlook, Downloads and Zone.Identifier streams to prove it was opened. Pivot to LNK files, Office trust records (macro enabled) and Prefetch of the handling app.
• Whether a saved or opened attachment carries Mark of the Web depends on the Outlook build and how it was saved; its absence is not proof the file came from elsewhere.
• Check Outlook rules and forwarding (stored in the mailbox) for business email compromise persistence.
• Several .ost files for one account usually mean the profile was recreated; the older OST may still hold mail deleted since.
• When an OST is locked or corrupt, the Windows Search index may still contain indexed message text.