Forensics: What is a PST file?

What is a PST file? A PST file (personal storage file) is Microsoft Outlooks file format for email storage. This single file, is a compound file, like a ZIP file, and can contain thousands of emails, contacts, tasks, and calendar entries. 

To view the contents of a PST file, the file can be mounted in Outlook or specialist forensic tools such as EnCase or FTK can be used.

PST files are important, if not critical, in forensic and electronic discovery investigations as they provide one of the primary storage methods for email within companies.

As email is the primary form of communicaiton not investigating PST files, is akin to missing out most of the evidence in a case (assuming the PST files exist in the first place).

Prior to Outlook 2003 the maximum size of a PST file was 2 GB, however this limit has now been removed.

Advertisements

5 Responses to “Forensics: What is a PST file?”

  1. Forensics: How do you view a PST in EnCase? « Data - Where is it? Says:

    […] How do you view a PST in EnCase? Posted on March 31, 2009 by Rob PST files, are one of the most important file types in corporate investigations, with the vast majority of  […]

  2. Forensics: Recovering Deleted MSGs from PST files « Data - Where is it? Says:

    […] PST files are compound files that contain email messages, contacts, tasks, etc. The PST files are read by Microsoft Outlook. Like other Microsoft files, PST files have their own file structure which includes ”unallocated space” from within the file. […]

  3. PST Repair Says:

    In addition to what you’ve written here, I posted some more details about PST files on my blog here:

    http://www.stellaroutlookpstrepair.com/blog/what-is-a-pst-file.html

    Note that the new file size maximum for Outlook 2003 and 2007 is 20GB – bigger than the old limit of 2GB, but not eaxctly unlimited either.

    • Rob Says:

      I believe that while there is a 20 GB recommended size, which can be forced through the registry, the PST file can exceed that if allowed. Though it is not recomended for stability issues.

      http://support.microsoft.com/kb/832925/

      • PST Repair Says:

        @Rob – Good point, thanks. I changed my blog post to say that Outlook 2003 and 2007 have a “recommended” maximum PST file size of 20GB. As you pointed out, you can go higher but Outlook tends to be unstable at larger PST file sizes.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: