This script will attempt to mount the highlighted PST/OST file and display its contents so that messages can be previewed and/or extracted to *.MSG files.

The script can either show the EnCase report for an item, or it can extract a copy of the item into the current case's temporary folder (using a URL-encoded name prefixed with the item GUID) and instruct Windows to open it. If the item doesn't have a recognisable extension, the user will be prompted to choose the application that should be used for that purpose.

If an item has no children, i.e., it's not a folder of some sort (emails with attachments are treated as folders), double-clicking the item will cause the EnCase report to be shown.

This notwithstanding, this operation can be invoked by right-clicking on an item, as can viewing the item externally.

EnCase will write the the result of exporting messages to *.MSG files to the console.

Note that the script may fail to process very large files.

This notwisthstanding, one user reported using the script successfully to parse a 15GB PST file across a limited bandwidth EnCase Endpoint Investigator connection.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training