Outlook Personal Folders (PST / OST)
| Format | Outlook Personal Folders (PST / OST) |
|---|---|
| Short name | PST |
| Category | database |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Outlook's mailbox file: e-mails, attachments, calendar, contacts and tasks in a B-tree based node database (.pst for archives and POP accounts, .ost as the offline cache of Exchange/Microsoft 365). Exists as 32-bit ANSI (older Outlook, 2 GB limit), 64-bit Unicode and Unicode with 4 KiB pages. Deleted items can remain in unallocated blocks. Optional 'compressible' or 'high' encoding obscures but does not protect the content.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 21 42 44 4E | !BDN | Signature '!BDN' |
| offset 8 (0x8) | 53 4D | SM | Content type 'SM' — Personal Storage Table (.pst) |
| offset 8 (0x8) | 53 4F | SO | Content type 'SO' — Offline Storage Table (.ost) |
Known extensions
.pst, .ost
References
- [MS-PST]: Outlook Personal Folders (.pst) File Format, v11.2 (Microsoft) https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-pst/141923d5-15ab-4ef1-a524-6dce75aae546
- Personal Folder File (PFF) format (libyal/libpff) https://github.com/libyal/libpff/blob/main/documentation/Personal%20Folder%20File%20(PFF)%20format.asciidoc
- ForensicsWiki — Personal folder file (PAB, PST, OST) https://forensics.wiki/personal_folder_file_(pab,_pst,_ost)/
Cite this entry
Crush Format Reference, “Outlook Personal Folders (PST / OST)”. https://kalink0.github.io/crush-forensics/formats/pst/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction