PST File Upload and Extraction

  • Updated

The PST File Upload & Extraction feature enables investigators to upload Microsoft Outlook PST files into OWL and extract emails and attachments into OWLDocs for analysis. Once extracted, email content, attachment content, and email metadata become searchable through the existing search functionality.

Note: Users can view the extracted emails and attachments within OWL; however, extracted attachments are currently not supported for direct opening or viewing from the PST extraction results.

Key Benefits

  • Upload Outlook PST files using the existing file upload process.
  • Extract emails and attachments while preserving the original folder hierarchy.
  • Search across email content, attachment content, and email metadata.
  • Preserve email metadata such as sender, recipient, subject, and date.

Uploading a PST File

Steps:

  1. Navigate to OWLDocs.
  2. Click on Upload File.
  3. Select the desired .pst file.
  4. Wait for the upload and virus scan process to complete.
  5. Once the scan passes successfully, the PST file appears in OWLDocs with the following options available in the Actions menu:
    • Quick Search PST
    • Index PST (Extract)

Quick Search PST

The Quick Search PST feature allows users to search email content within a PST file before performing the extraction process.

Steps to Perform Quick Search PST

  1. Locate the uploaded .pst file in OWLDocs.
  2. Click the Actions menu associated with the PST file.
  3. Select Quick Search PST.
  4. The system redirects to the Quick Search PST (Real-Time Scan) page.
  5. Enter a keyword to search within the emails contained in the PST file.
  6. Optionally, specify a Folder Filter to limit the search to a particular folder within the PST.

  7. Click Search to view the matching results.

  8. To return to OWLDocs, click Back to OWLDocs.

Index PST (Extract)

  1. Locate the uploaded .pst file in OWLDocs.
  2. Click the Actions menu associated with the PST file.
  3. Select Index PST (Extract).
  4. A confirmation page is displayed indicating that the file has been submitted for the PST indexing job.
  5. The indexing process runs in the background, and the user will receive a notification once indexing is completed.
  6. To return to OWLDocs, click Back to OWLDocs.
  7. After successful completion of the indexing process, the document status is updated to PST_Indexed.

Indexed Search Benefits

Once the PST file has been successfully indexed:

  • Users can browse the extracted PST folder structure.
  • Search performance is significantly improved through indexed searching.
  • Users can search email content and metadata more efficiently.
  • Extracted PST content becomes available for further investigation and analysis within OWL.

Browse PST Emails

Once a PST file has been successfully indexed and extracted, users can browse the extracted emails, view email details, and access the associated attachments through the PST browser.

Steps:

  1. Locate the uploaded .pst file in OWLDocs.
  2. Click the Actions menu associated with the PST file.
  3. Select Browse PST Emails.
  4. The Browse PST Emails page opens, displaying the extracted PST folder structure.
  5. Navigate through the folders to browse the available emails and attachments.
  6. Select an email to view its details in the details pane on the right side of the screen.
  7. The selected email displays information such as:
  • Subject
  • Sender
  • Recipients
  • Date and Time
  • Email Content
  • Associated Attachments

       8.Users can browse multiple emails and review their contents as needed.
       9. After completing the review, click Back to OWLDocs to return to the OWLDocs page. 

 

Search PST (Indexed)

The Search PST (Indexed) feature allows users to perform fast and comprehensive searches across indexed PST content. Users can search emails based on the email subject, body content, sender, and recipients. Additional filters are available to further refine search results, including folder name, sender email address, and date range.

When a search is performed, the system returns all matching email records. Users can then review the email details and related information directly from the search results.

Steps:

1. Locate the uploaded .pst file in OWLDocs.

2. Click the Actions menu associated with the PST file.

3. Select Search PST (Indexed).

4. The Search Indexed PST Emails page opens.

5. Enter one or more search criteria:
Subject
Body 
Sender 
Recipients

6. Optionally, apply additional filters:

Folder Name
Sender Email Address
Date Range

7. Click Search.
8. The system displays all matching email results based on the specified search criteria and filters. 

9. Select a search result to view the email details. 

10. After reviewing the results, click Back to OWLDocs to return to the OWLDocs page.