Does anyone know if there is a way to extract Outlook emails with attachments from memory? What I have tried is to use volatility to dump PST files from memory and then use libpff to recover the attachments from PST files, but for some reason, libpff could not recover the attachments with contents (I only got an empty file).

Does anyone have any advice about how to use libpff with other tools to extract email attachments from memory?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.