To read messages in pst or ost files, in python, refer to the following functions in https://github.com/PacktPublishing/Learning-Python-for-Forensics/blob/master/Chapter%2010/pst_indexer.py
folderTraverse(base)
checkForMessages(folder)
processMessage(message)
To read the attachments also, you could modify processMessage(message)
def processMessage(message, folder):
attachments = []
total_attachment_size_bytes = 0
if message.number_of_attachments > 0:
for i in range(message.number_of_attachments):
total_attachment_size_bytes = total_attachment_size_bytes + (message.get_attachment(i)).get_size()
# get the content of the attachment file
attachments.append(((message.get_attachment(i)).read_buffer((message.get_attachment(i)).get_size())).decode('ascii', errors="ignore"))
return {
"subject": message.subject,
"sender": message.sender_name,
"header": message.transport_headers,
"body": message.plain_text_body,
"creation_time": message.creation_time,
"submit_time": message.client_submit_time,
"delivery_time": message.delivery_time,
"attachment_count": message.number_of_attachments,
"total_attachment_size": total_attachment_size_bytes,
"attachments": attachments
}
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…