# Standards - Outlook PST Email Forensics
## Standards
- MS-PST: Outlook Personal Folders (.pst) File Format
- MS-OXMSG: Outlook Item Message File Format
- NIST SP 800-86: Guide to Integrating Forensic Techniques
## Tools
- libpff/pffexport: Open-source PST parser
- pypff (Python): Python bindings for libpff
- MailXaminer: Commercial email forensics
- PST Walker: Email investigation software
- Kernel Outlook PST Viewer: Free PST reader
## Key Artifacts
- Email headers (Received, X-Originating-IP, Message-ID)
- Deleted items (Recoverable Items folder)
- Attachments (malware, exfiltrated data)
- Calendar events, contacts, tasks