Forensicspstoutlookemailforensicsmboxldifcontacts

libpst

Library and tools for reading and extracting data from Microsoft Outlook PST files. Supports exporting emails to mbox, MH, KMail formats and contacts to LDIF or DII formats.

Description

libpst provides a library and associated tools for accessing and processing Microsoft Outlook Personal Storage Table (PST) files. The core library (libpst4t64) enables applications to read PST data, while development files (libpst-dev) include headers and documentation for building custom tools. The pst-utils package contains command-line utilities for common extraction tasks.

Primary use cases include digital forensics investigations requiring Outlook email and contact recovery, data migration from PST to standard email formats, and preparation of contact data for LDAP import. Tools like readpst export emails to mbox, MH, or KMail-compatible formats, while specialized utilities handle contacts (pst2ldif) and legal document formats (pst2dii).

The suite supports various output formats and includes options for handling deleted items, attachments, and character encoding issues common in PST files. Debug logging is available across tools for troubleshooting corrupted or complex PST structures.

How It Works

libpst implements Little Endian parsing of PST file structures to extract email messages, attachments, contacts, and metadata. It processes the proprietary PST container format, decoding email headers, bodies (including RTF), CC/BCC fields, and timestamps. Output modules convert native PST data to standard formats like mbox (RFC822), MH, LDIF (LDAP), VCard, or DII load files for legal discovery. The library handles character set detection and supports debug logging of binary PST parsing operations.

Installation

bash
sudo apt install pst-utils

Flags

-d <filename>Debug to file. This is a binary log. Use readlog to print it (lspst)
-lPrint the date, CC and BCC fields of emails too (by default only the From and Subject) (lspst)
-f <date_format>Select the date format in ctime format (by default "%F %T") (lspst)
-hHelp. This screen (all tools)
-VVersion. Display program version (all tools)
-f ttf-font-fileSet the font file (pst2dii)
-B bates-prefixSet the bates prefix string (pst2dii)
-O dii-output-fileSet the dii load file output filename (pst2dii)
-b bates-numberSet the starting bates sequence number (pst2dii)
-c bates-colorSpecify the color of the bates stamps as 6 digit hex (pst2dii)
-o dirnameOutput directory to write files to (pst2dii)
-b ldapbaseset the LDAP base value (pst2ldif)
-c classset the class of the LDAP objects (may contain more than one) (pst2ldif)
-l lineextra line to insert in the LDIF file for each contact (pst2ldif)
-ouse old schema, default is new schema (pst2ldif)
-C charsetcharacter set for items with an unspecified character set (readpst)
-DInclude deleted items in output (readpst)
-L <level>Set debug level; 1=debug,2=info,3=warn (readpst)
-MWrite emails in the MH (rfc822) format (readpst)
-SSeparate. Write emails in the separate format (readpst)

Examples

Display help for the lspst tool which lists data in PST files
lspst -h
List PST file data including date, CC, BCC fields using custom date format
lspst -l -f "%F %T" example.pst
Display help for pst2dii which extracts emails to DII load format
pst2dii -h
Extract PST emails to DII format with custom font, output file, and directory
pst2dii -f font.ttf -O output.dii -o /tmp/output example.pst
Display help for pst2ldif which extracts contacts to LDIF format
pst2ldif -h
Extract PST contacts to LDIF with specified LDAP base DN
pst2ldif -b "ou=contacts,dc=example,dc=com" example.pst
Display help for readpst which converts PST files to mbox and other formats
readpst -h
Convert PST to MH format including deleted items
readpst -M -D example.pst
Updated 2026-04-16kali.org ↗