Email Artifacts

# Analyze Outlook PST files with libpff tools (available in SIFT)
# libpff provides pffexport — extracts PST contents to readable files

# Export entire PST to directory (messages as .eml, attachments preserved)
pffexport -f text -t all -o /cases/CASE001/pst-export/ \
  "/evidence/jsmith.pst"

# -f text: export as plain text
# -t all: export all folders including Deleted Items, Recoverable Items
# Output directory: one folder per PST folder, one file per message

# List folder structure without exporting
pffinfo "/evidence/jsmith.pst"

# Alternatively: readpst (another libpst tool, more Unix-friendly)
readpst -u -o /cases/CASE001/pst-export/ "/evidence/jsmith.pst"
# -u: unicode mode
# -o: output directory

"""Search PST file for specific content using pypff."""
import pypff
import sys
from datetime import datetime

def search_messages(pst_path: str, search_term: str):
    pst = pypff.file()
    pst.open(pst_path)
    root = pst.get_root_folder()
    results = []
    _walk_folder(root, search_term.lower(), results)
    pst.close()
    return results

def _walk_folder(folder, term, results, path=""):
    for i in range(folder.number_of_sub_folders):
        subfolder = folder.get_sub_folder(i)
        _walk_folder(subfolder, term, results, path + "/" + subfolder.name)

    for i in range(folder.number_of_sub_messages):
        msg = folder.get_sub_message(i)
        subject = msg.subject or ""
        sender = msg.sender_name or ""
        body = ""
        try:
            body = msg.plain_text_body or ""
            if isinstance(body, bytes):
                body = body.decode("utf-8", errors="replace")
        except Exception:
            pass

        if (term in subject.lower() or term in sender.lower() or
                term in body.lower()):
            dt = msg.client_submit_time
            results.append({
                "folder": path,
                "subject": subject,
                "sender": sender,
                "time": str(dt),
                "body_preview": body[:200]
            })

if __name__ == "__main__":
    pst_path = sys.argv[1]
    search_term = sys.argv[2]
    for r in search_messages(pst_path, search_term):
        print(f"[{r['time']}] {r['folder']} | {r['sender']} | {r['subject']}")
        print(f"  Preview: {r['body_preview'][:100]}")
        print()

# Microsoft 365 mailbox audit log queries
# Requires: Exchange Online PowerShell module, Global Admin or Compliance role

Connect-ExchangeOnline

# Search unified audit log for mailbox access
Search-UnifiedAuditLog -StartDate "2026-09-15" -EndDate "2026-09-20" `
  -UserIds "jsmith@corp.com" `
  -Operations "MailItemsAccessed" `
  -ResultSize 1000 |
  Select-Object CreationDate, UserIds, Operations,
    @{n="Details"; e={$_.AuditData | ConvertFrom-Json}} |
  Export-Csv "mailbox-access.csv" -NoTypeInformation

# Hunt for suspicious inbox rules (attacker auto-forward/delete rules)
Get-InboxRule -Mailbox "jsmith@corp.com" |
    Where-Object {
        $_.ForwardTo -or $_.ForwardAsAttachmentTo -or
        $_.DeleteMessage -or $_.MoveToFolder -or $_.RedirectTo
    } |
    Select-Object Name, ForwardTo, DeleteMessage, MoveToFolder |
    Format-Table -AutoSize

# Check for email forwarding rules (SMTP forwarding at account level)
Get-Mailbox "jsmith@corp.com" |
    Select-Object ForwardingAddress, ForwardingSmtpAddress, DeliverToMailboxAndForward

# Message Trace — track specific email's delivery path
Get-MessageTrace -SenderAddress "external@domain.com" `
    -StartDate "2026-09-15" -EndDate "2026-09-20" |
    Select-Object Received, SenderAddress, RecipientAddress, Subject, Status, MessageId |
    Format-Table -AutoSize