Greetings Breezers! I am frequently asked about PST files. People know that PST files are everywhere, but what makes this type of file so special? How and why do PST files need to be handled differently? Let’s take a look at what information could be housed in a PST file and how that information can be extracted if the PST file is processed with electronic discovery software.
Container Files
PST files are often referred to as “container files”. This is because a PST file is a database file that opens with Microsoft Outlook and contains different items. Any of the items within a PST can be saved out as a file, or extracted during electronic discovery software processing. Each PST file may be generated with one type of item, such as a PST only containing emails, or a variety of item types, a PST file with email items, attachments, contact items, etc. It is important to have software that gives you the ability to processes PST files in order to retrieve all of the PST items. These are examples of PST items:
Emails Embedded Files/Items in Email
Email Attachments Calendar Items
Embedded Files/Items in Attachments Contact Items
When a PST file is processed using electronic discovery software, each of the PST items and the metadata is linked together, typically, using a DocID. At this point, the files can be reviewed natively by generating a native load file or converted to TIF. The amount of time it takes for the TIF conversion varies and depends, among other things, on what files are extracted from the PST and the amount of files that have been extracted.
What to Expect in the PST EDD Output
In the PST output, you will have many files that have been extracted from the PST during the processing. It is common to have an output that is much larger than the original PST file. So it is very important to enough disk space in your output to accommodate the extracted files and items.
Each of the items should have metadata associated with that DocID. The metadata that is extracted will depend on the type of file that was saved out. The date sent for an email may be different than the date created for the attachment of the email. Also, it is very important for attachments to be cross referenced to the email it was attached to. For example:
Emails: Attachment Files:
To/From Author
Date Sent/Received Date Created
Attachment Reference Parent Reference
Before getting started, make sure you have checked your production requirements so you know how to setup your PST processing. Of course, there is much more to file processing. Feel free to ask us questions or speak up if we left something out. We would love to hear from you. What unique situations have you encountered when dealing with PST processing? Do you typically process these files in-house or outsource PST files?
Posted on
Mon, October 12, 2009
by Brittney Aleman
filed under