This script will attempt to mount the highlighted PST/OST file and display its contents so that messages can be previewed and/or extracted to *.MSG files.
The script can either show the EnCase report for an item, or it can extract a copy of the item into the current case's temporary folder (using a URL-encoded name prefixed with the item GUID) and instruct Windows to open it. If the item doesn't have a recognisable extension, the user will be prompted to choose the application that should be used for that purpose.
If an item has no children, i.e., it's not a folder of some sort (emails with attachments are treated as folders), double-clicking the item will cause the EnCase report to be shown.
This notwithstanding, this operation can be invoked by right-clicking on an item, as can viewing the item externally.
EnCase will write the the result of exporting messages to *.MSG files to the console.
Note that the script may fail to process very large files.
This notwisthstanding, one user reported using the script successfully to parse a 15GB PST file across a limited bandwidth EnCase Endpoint Investigator connection.
This script was developed for use in EnCase training. For more details, please click the following link:
734 items
10 item
13 item
211 item
88 item
169 item
1 item
9 item
237 item