PST/OST Analysis, Email Headers & Browser Artifacts
Section 9 of 12
Definition: Analysis of email messages, headers, attachments, and mailbox files to investigate crimes, data breaches, and communication patterns.
Email headers contain critical metadata about message routing and authenticity.
From: sender@example.com
To: recipient@company.com
Subject: Important Document
Date: Wed, 3 Dec 2025 10:15:00 -0500
Message-ID: <abc123@example.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_Part_123"
Received: from mail.example.com (192.168.1.50)
by mx.company.com with ESMTP id ABC123
Wed, 3 Dec 2025 10:15:05 -0500
Return-Path: <sender@example.com>
X-Originating-IP: [203.0.113.45]
X-Mailer: Microsoft Outlook 16.0
PST (Personal Storage Table): Stores local copies of emails, calendar, contacts
OST (Offline Storage Table): Cached copy of Exchange mailbox
Windows PST:
C:\Users\[user]\Documents\Outlook Files\
C:\Users\[user]\AppData\Local\Microsoft\Outlook\
# Convert PST to MBOX
readpst -o output_dir mailbox.pst
# Detailed output
readpst -D -o output/ mailbox.pst
# Separate folders
readpst -S -o output/ mailbox.pst
Browsers store extensive data about user activity, including visited sites, downloads, searches, and autofill data.
Private/Incognito mode reduces but doesn't eliminate all artifacts. DNS cache, router logs, and ISP logs may still contain evidence.
Windows:
macOS:
Linux:
# Open Chrome history
sqlite3 History
# View browsing history
SELECT url, title,
visit_count,
datetime(last_visit_time/1000000-11644473600, 'unixepoch')
FROM urls
ORDER BY last_visit_time DESC
LIMIT 20;
Windows:
macOS:
Linux:
# Open places database
sqlite3 places.sqlite
# View history
SELECT url, title,
visit_count,
datetime(last_visit_date/1000000, 'unixepoch')
FROM moz_places
ORDER BY last_visit_date DESC
LIMIT 20;
History (index.dat):
Cache:
Cookies:
Registry:
User Data:
Edge now uses Chromium engine, same structure as Chrome:
Open-source SQLite viewer
Multi-browser history viewer
Chrome/Chromium forensics
Commercial forensic tool
Integrated browser analysis
# Copy browser profile
cp -r ~/.mozilla/firefox/*.default/ /case/firefox/
# Use SQLite
sqlite3 History
.tables
SELECT * FROM urls;
What Cookies Reveal:
SELECT host_key, name,
value,
datetime(creation_utc/1000000-11644473600, 'unixepoch')
FROM cookies
WHERE host_key LIKE '%facebook%';
Cache Contents:
Tools:
Always create forensic copies before analysis. Close the browser before accessing SQLite databases to avoid corruption.