PST Forensic Analysis: Viewing Raw HTML and Metadata Without Altering Evidence

Core Objective of Digital Evidence Integrity

The analysis of PST files includes collection & preservation of digital evidence. Due to the emails, attachments, calendar entries, contacts, and other information, PST files are highly valued in DFIR (digital forensics and incident response). A PST can contain several layers of information. Looking only at the visible email body may leave important evidence unnoticed. 

• Email Header Information
• Raw HTML of the Email
• Messaging Application Programming Interface
• Message Timestamps
• MIME Information

Why Should You Avoid Opening the Original PST Directly?

The first rule of digital evidence examination is to protect the original evidence. The PST is not supposed to be handled like any other document that can easily be opened, modified, repaired, and saved. Any modifications to the file may make it hard for you to prove that there have been no changes to the evidence from the time it was collected. 

Most forensic investigations usually start with creating a copy of the evidence, followed by the generation of its hash, such as SHA-256. Read-only analysis is another important part of this process. This gives investigators a simple separation: Original PST → Preserve → Verify → Analyze the forensic copy.

Method 1: Manual PST Forensic Analysis Using Open-Source Tools

1. Create a copy: Keep the original PST safe and work only on a copy.
2. Generate a hash: Calculate a SHA-256 hash to check file integrity.
3. Check folders: Use pffexport to view and extract the PST folder structure.
4. Extract emails: Use readpst to extract emails for further analysis.
5. Check metadata: Review headers, timestamps, Message-ID, and MIME details.
6. View raw HTML: Examine the HTML source, links, and embedded content.
7. Record findings: Save the results separately without changing the original PST.

Limitations of Manually View Raw Email Data

• Requires technical knowledge of command-line tools.
• Takes more time when working with large PST files.
• Multiple tools may be needed to view HTML, headers, and metadata.
• Extracting emails and attachments can require separate steps.
• Searching thousands of emails can be slow and difficult.
• Producing organized forensic reports may require additional tools.
• Incorrect commands can lead to errors during extraction or analysis.

Dedicated Tool For PST Forensic Analysis

The SysInfo PST file Forensic Analysis Tool is the professional tool to open, view, export, or migrate PST files without requiring Microsoft Outlook. It handles healthy, corrupted, archived, or password-protected Outlook PST files. Built for IT admins, investigators, legal professionals, and compliance teams. Provides complete mailbox visibility, advanced email search, metadata preservation, and flexible export options. Also, directly export to Microsoft 365 and other formats. With this tool, you can easily open PST files on Mac or Windows.

How to Analyze Email Evidence Without Modifying Original File?

• Download the software and load your PST files.
• Expand the folder hierarchy, double-click to open, and search the emails (If you need to).
• Also, use Smart Search and the date range filter. Click on Saving options.
• Apply advanced features and click Save.

Why Use a Raw HTML Email Viewer Tool?

• View PST emails without Outlook.
• Examine email headers and metadata.
• Check raw HTML email content.
• Search emails in large PST files.
• Review attachments and message details.
• Reduce the need for multiple command-line tools.

Note: A PST viewer should be used on a verified working copy of the evidence. Loading a file into a viewer does not, by itself, establish that the original evidence was not altered. Investigators should follow their own evidence-preservation and verification procedures.

Manual Method vs. Professional PST Forensic Analysis Tool

Conclusion

PST forensic analysis helps investigators examine email evidence beyond the information visible in Outlook. By reviewing raw HTML, email headers, timestamps, attachments, and other available metadata, they can collect more information for their investigation. The manual method using open-source tools can work for basic extraction and technical analysis, but it may require several steps and additional utilities. A dedicated tool provides a more convenient way to browse and examine PST files.

Frequently Asked Questions

About The Author:

Simran Bhatia

Simran Bhatia is a technical content writer engaged in writing clear, concise, and SEO-optimized content. With a background in computer science and a passion for writing, I thrive to deliver complex technical content in simple layman terms.