Guide · Agent skill
How to use the Outlook PST Email Forensics agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the analyzing-outlook-pst-for-email-forensics skill, a set of instructions and helper code that lets an AI agent examine Outlook PST and OST archive files as forensic evidence. It is written for analysts, e-discovery practitioners and students who may not have used agent skills before. By the end you will know what the skill does, how to add it to your agent, how to phrase requests so it triggers, and what it needs to run safely.
Outlook PST Email Forensicsmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page. It contains SKILL.md, the scripts folder and the references folder.
- 2Unzip it into the skills folder. Unzip into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder. In the Claude apps, upload the ZIP under Settings → Capabilities → Skills instead.
- 3Install the Python library. Run pip install libpff-python. Python 3.8 or newer is required.
- 4Copy the evidence file. Hash the original PST or OST file with SHA-256, then work only on a copy.
- 5Ask for the analysis in plain language. Describe the file and the goal, such as extracting headers or recovering deleted items. Review the output and the scripts before relying on the results.
What the skill makes the agent do
Once installed, the agent knows how to work with Microsoft Outlook PST (Personal Storage Table) and OST (Offline Storage Table) files. The skill describes how to extract message content, transport headers, attachments, deleted items and MAPI metadata, including items recovered from the Recoverable Items folder.
The skill points the agent to open-source parsers, libpff and pypff, and to the pffexport and pffinfo command-line tools. It also includes a Python helper script that opens a PST file, reads message metadata and hashes the file with SHA-256.
- List messages and folders in a PST file
- Read transport headers such as Received, Message-ID and X-Originating-IP to trace routing
- Export attachments to disk for review
- Look for items in the Recoverable Items folder
- Hash the original evidence file with SHA-256
Install the skill in Claude
Download the skill ZIP from this page. Then choose one of the two methods below.
For Claude Code, unzip the file into ~/.claude/skills/ to make it available in all your projects, or into a project's .claude/skills/ folder to limit it to that project.
In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
Install the required Python library
The skill needs Python 3.8 or newer and the pypff / libpff Python library. The library is installed with pip under the name libpff-python. The libpff command-line tools, such as pffexport and pffinfo, are optional but useful for bulk export and quick checks.
Commercial options named in the skill are MailXaminer, Forensic Email Collector and SysTools PST Forensics. They are not required.
pip install libpff-pythonTrigger the skill with natural requests
You do not need to name the skill. Describe the task and mention the file type. The agent should pick up the skill when your request involves Outlook archives and forensic or e-discovery work. Be specific about the goal, such as headers, attachments or deleted items.
Give the agent the path to a copy of the file, not the original, and say what you want back.
- Parse evidence.pst and list every folder with its message count.
- Extract the transport headers from the messages in the Inbox and show the Received chain for each one.
- Export all attachments from archive.pst and give me their names, sizes and SHA-256 hashes.
- Check the Recoverable Items folder in this OST copy for deleted messages.
- Build a timeline of messages between two addresses from this PST export.
Command-line reference for the core tasks
The skill documents these libpff commands. Run them against a copy of the file. The -t option sets the output directory.
Use -m items to export email messages only, -m recovered to export recovered or deleted items, and -m all to export everything. Use pffinfo to see general information about the file before you start.
pffexport -m all evidence.pst -t exported_pst
pffexport -m items evidence.pst -t exported_emails
pffexport -m recovered evidence.pst -t recovered_items
pffinfo evidence.pstSafety notes before you run the scripts
The skill runs scripts. It does not use the network. Review scripts/agent.py before running it, and run it on a copy of the evidence so the original stays unchanged. Hash the original file first, as the workflow in the skill recommends.
Outputs contain private message content. Handle them under the legal authority that applies to your case. The skill is not intended for live mailboxes or production Exchange servers, and it does not produce court-ready chain-of-custody reports.
- Work on exported copies, never on live mailboxes or production servers
- Hash the original with SHA-256 and record the value
- Treat extracted messages and attachments as sensitive
- Document each step for your own chain-of-custody record
What people use it for
- Reviewing a mailbox archive collected during an incident response case to find suspicious attachments
- Tracing the routing of a phishing message using its Received and X-Originating-IP headers
- Recovering deleted messages from the Recoverable Items folder of an exported OST copy during e-discovery
- Building a list of messages and their folders to reconstruct communication patterns
- Teaching students how PST files and MAPI properties are organised
Frequently asked questions
How do I install the analyzing-outlook-pst-for-email-forensics skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
What do I need to run this skill?
You need Python 3.8 or newer and the libpff-python library, installed with pip install libpff-python. The libpff tools pffexport and pffinfo are optional.
Is the Outlook PST Email Forensics skill free?
The skill is licensed under Apache-2.0, as listed on this page. The commercial tools it mentions, MailXaminer, Forensic Email Collector and SysTools PST Forensics, are separate products and are not needed to use the skill.
What are alternatives to this skill for PST forensics?
The skill's reference notes list commercial options such as MailXaminer, Forensic Email Collector and SysTools PST Forensics, and free readers such as Kernel Outlook PST Viewer. Those are different tools, and the skill's own reference notes do not say how they compare on features. Choose based on whether you need open-source workflows or a commercial product with reporting.
Can this skill produce court-ready evidence reports?
No. The skill relies on open-source libraries and reference notes rather than court-ready output. The workflow suggests documenting findings with chain of custody, but you need to do that record-keeping yourself.
Does the skill send my email data over the internet?
The skill is listed as not using the network. It does run Python scripts, so review scripts/agent.py and work on a copy of the file before you run it.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits digital forensics and incident response analysts, e-discovery practitioners and students who work with exported PST or OST copies and want a structured, open-source procedure. It is a poor fit for live mailboxes, production Exchange servers, or anyone who needs polished, court-ready reporting; for those, a commercial tool is the better choice.
Download the skill