Solved

Export the search results from Outlook 2003 to a PST file

Posted on 2009-03-30
6
1,057 Views
Last Modified: 2012-05-06
I've been asked to start researching ways to audit a number of Outlook mailboxes for search terms such as FROM, SENT TO, and other terms in the body of the mail in addition to a date range.  Now all these parameters I can easily populate in performing a search, but what I'd like to do is export the search results to a PST file.  Exporting to a PST file is easy enough (e.g. Contacts, Calendar, Inbox) but my research on exporting the results of a *search only* have turned up fruitless.

Some background info. to help:  one of my clients has been subpoenaed; they have asked me to very rapidly put together a mechanism for searching each individual mailbox, export the relevant emails and (possibly) upload them into a piece of Lexus software called Concordance (apparently an effective aggregator of data in legal situations).  The Outlook mailboxes are hosted by an offsite Exchange server so there's no central place to search multiple mailboxes, it would have to take place on each individual Outlook 2003 profile which is stored as an OST file.

Any help on this would be greatly appreciated.  Hope I filled in all the blanks.

Thanks kindly
0
Comment
Question by:bluefishsolutions
  • 3
  • 2
6 Comments
 
LVL 28

Expert Comment

by:peakpeak
ID: 24025890
0
 

Author Comment

by:bluefishsolutions
ID: 24113800
Actually my needs have evolved a bit.

I discovered that I could simply run a search and select COPY TO FOLDER from the search results.  Here's where things have changed.  I need to perform a search on a specific domain (let's call it acme.com) that has sent messages to my client, and perform a separate search looking for messages sent from my client to acme.com

However I need to search within the message header (the area with the IP addresses) to be satisfied that my search was comprehensive.

What do I need to perform searches on Outlook PST files that also examines message headers?

Thanks
0
 
LVL 28

Expert Comment

by:peakpeak
ID: 24113808
You need to look at Sue's page, maybe buy the book
http://www.outlookcode.com

0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 

Author Comment

by:bluefishsolutions
ID: 24113823
That would ordinarily be helpful if I had lots of time but I need a canned solution.

Is there anything in the book that specifically addresses my needs?  I don't have more than a week so a book is out.

Thanks
0
 

Accepted Solution

by:
bluefishsolutions earned 0 total points
ID: 24137850
I found a good solution here:

http://www.paraben-forensics.com/catalog/product_info.php?cPath=25&products_id=393

Paraben Email Examiner v5.9 (i needed to use their PST converter utility first) searches every email in depth and allows you to export as eml files.  I then used Outlook Filler to put the results back into a PST file while retaining header information.

This process strips the attachment but that's not critical right now..
0
 

Expert Comment

by:dcmathis
ID: 34623272
I realize that this is a very old post, but I find myself in a very similar situation.  However, I need to be able to export the search results with attachments exported intact.  Any ideas?
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Find out how to use dynamic social media in email signatures with this top 10 DOs & DON’Ts.
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now