Hello. Welcome to this course in which we're talking about using Python for data collection. In this video we're going to talk about analyzing the contents of outlooks, stored data files containing emails on our local machine. This is the PST file format on a Computer. To make things a lot easier for parsing this PST file format. We're going to take advantage of the Lib Adam Library, which has subsections lib and then.pff. Which grants access to function called pffArchive. This pfifArchive defines the structure of a PST file. Allowing us to very easily access the data inside of it, iterate through it, and take a look at the contents of the message is stored in an outlook data file. Before we can start analyzing these data files, we need to know where to look for them on the system. We have a sample user directory here for accessing the PST file of a local user on the system. Typically it's going to be located in their user directory, documents, folder, outlook files, and then you may find one or more PST files stored there. Identifying those and accessing them on the system is fairly simple because all you really need to do is look for this directory and iterate over the PST files stored with them. In this case we have a sample PST file set-up for this demo. Once we've got that filename to look at. We can call pffArchive, pass in the file name and it will parse the result into the archive variable, which allows us to gain access to the folders and files stored within the outlook archive. We can iterate over that list of folders by calling archive.folders, and then taking a look at each folder within the archive. Inside each folder, we can determine how many sub- messages are stored in that particular folder and verify that the folder is not empty by checking to see if that number of sub-messages is not equal to zero. If we have sub-messages, we can then iterate over each message in the folder and print out the information about that message. There's a variety of different ways to access data in pffArchive, and within a particular message, you can get all of the message headers, attachments etc. Here just doing a simple demo of searching for the sender name, the subject, and the plain text body of the message can also access the HTML body of the message, etc. as well. Taking a look at this in the terminal, we can run this with python LocalEmailAccounts.py hit "Enter" and we see that this particular PST file only contains a single message. The sender is Howard Poston, the subject is test, and the message is, this is a test. Not a particularly interesting email message, but it illustrates how easy it is to access the contents of a PST file on a Windows computer using Python. There's a variety of different applications for this, from a data collection standpoint, the ability to look at the PST files and parse through them is useful for looking for information of the interests that might be contained within these files. We could use regular expressions to look for certain types of information like bank account and credit card numbers, email addresses, phone numbers, social security numbers, etc. Then our Python script could collect all of that information, bundle it up, and send it onto an attacker. Which could use those data for credit card fraud, etc. Or they could just simply be looking at what looks like normal communications between the email account that they're looking at and other email accounts, and preparation for a spear phishing attack. Impersonating one abusers, vendors, or other trusted parties. This demonstrates how Python can be very easily used to access and parse through the email data stored within a Microsoft Outlook PST file. Thank you.
