Skip to content
Get packs

Outlook PST Email Forensics

Lets the agent parse Outlook PST/OST archives to extract emails, headers, attachments and deleted items for forensic review.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
5 files

What it does

This skill teaches an AI agent how to examine Outlook email archive files (PST and OST) as forensic evidence. Once installed, the agent knows how to use open-source parsers such as libpff and pypff to list messages, read transport headers for tracing routes, export attachments, and look for items in the Recoverable Items folder. It also includes a Python helper script that opens a PST file, reads message metadata and hashes the file with SHA-256.

Great for

  • Digital forensics or incident response analysts reviewing a mailbox archive from a case
  • E-discovery practitioners who need a structured procedure for extracting email metadata
  • Students learning how PST files and MAPI properties are organised

Skip it if

  • Investigations on live mailboxes or production Exchange servers, since this works on exported files and a copy should be used to preserve evidence integrity
  • Users who need a polished commercial tool with chain-of-custody reporting; the skill relies on open-source libraries and reference notes rather than court-ready output
  • Non-expert users handling sensitive personal email, since the outputs contain private message content and should be handled under proper legal authority

Try asking

  • “Parse evidence.pst and list all messages with sender, dates and Received headers for a timeline”
  • “Export attachments from this Outlook archive and flag any executable files for malware review”
  • “Find items in the Recoverable Items folder of this PST and summarise recovered deleted emails”
  • “Trace the routing of the suspicious message in this OST file using its transport headers”
Step-by-step guide: how to use Outlook PST Email ForensicsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 5 original files, the Apache-2.0 licence and an attribution note.

    analyzing-outlook-pst-for-email-forensics.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-outlook-pst-for-email-forensics.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-outlook-pst-for-email-forensics.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work on a verified forensic copy of the PST rather than the original file, and record the SHA-256 hash before and after analysis.
  • Review scripts/agent.py before running it, since it opens and reads evidence files on your machine; check the output limits (for example the 1000-message cap) against your case size.
  • Ask the agent to explain each finding with its source header or folder path so results can be checked and cited in a report.

What's inside

  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.