Open Source C Library for Outlook File Formats

Getting Started with libpff

To begin using libpff, you can clone the source code from its official [libpff GitHub](https://github.com/libyal/libpff) repository and build it using CMake or autotools. Precompiled binaries are not officially distributed, so building from source is the recommended approach. The project includes detailed build instructions and dependencies like libyal/libcerror and libyal/libcdata. Once built, you can use the provided command-line tools (e.g., `pffexport`, `pffinfo`) to inspect and extract data from PST/OST files. For programmatic use, link against the compiled library in your C/C++ application. The library is lightweight and has minimal external dependencies, making it suitable for embedded or forensic environments.

git clone https://github.com/libyal/libpff.git
cd libpff
./configure
make
sudo make install

Extract Emails and Attachments from PST Files

libpff provides robust functionality to parse PST files and extract individual email messages along with their attachments. Developers can traverse the folder hierarchy, access message properties (e.g., subject, sender, recipients, timestamps), and export raw MIME content or structured data. The library supports both ANSI and Unicode string encodings, ensuring compatibility with Outlook versions from the 1990s up to modern releases. It also handles compressed OST files (4K-page DEFLATE), which are common in newer Outlook versions. This makes libpff ideal for email migration tools, e-discovery platforms, and forensic analysis where accurate extraction of message bodies and attachments is critical. The API exposes low-level access to MAPI properties, enabling fine-grained control over data retrieval.

pff_file_t *pff_file = NULL;
pff_error_t *error = NULL;

if (pff_file_open(&pff_file, "example.pst", PFF_OPEN_READ, &error) != 1) {
    // handle error
}

pff_item_t *root_item = NULL;
if (pff_file_get_root_item(pff_file, &root_item, &error) != 1) {
    // handle error
}

// Iterate over items and extract messages
pff_item_t *item = NULL;
while (pff_item_get_sub_item(root_item, &item, &error) == 1) {
    // Process each item (e.g., folder or message)
    pff_item_free(&item, NULL);
}
pff_item_free(&root_item, NULL);
pff_file_close(pff_file, &error);

Forensic Analysis of Corrupted Outlook Files

libpff includes specialized capabilities for forensic analysis of damaged or partially corrupted Outlook files. It can parse files with missing or inconsistent headers, recover orphaned items, and reconstruct message trees even when internal indexes are broken. The library supports files with encryption type "none" and can bypass certain structural errors to extract usable data. This is especially valuable in digital forensics investigations where evidence may reside in degraded PST/OST files. libpff also provides detailed logging and error reporting, enabling analysts to track parsing decisions and identify data loss points. Combined with its MAPI property extraction, libpff serves as a reliable foundation for building forensic tools that meet legal and compliance standards.

pff_file_t *pff_file = NULL;
pff_error_t *error = NULL;

// Open with recovery mode (if supported)
if (pff_file_open_recover(&pff_file, "corrupted.pst", PFF_OPEN_READ, &error) != 1) {
    // fallback to standard open
    pff_file_open(&pff_file, "corrupted.pst", PFF_OPEN_READ, &error);
}

// Use item recovery functions
pff_item_t *recovered_item = NULL;
if (pff_file_get_recovered_item(pff_file, &recovered_item, &error) == 1) {
    // Process recovered item
    pff_item_free(&recovered_item, NULL);
}
pff_file_close(pff_file, &error);

Parse MAPI Properties and Metadata

libpff enables deep inspection of MAPI properties embedded within Outlook items. Developers can retrieve standard properties like `PR_SUBJECT`, `PR_SENDER_NAME`, `PR_MESSAGE_DELIVERY_TIME`, and custom properties defined by applications. The library exposes a property set API that allows iteration over all properties of a message, folder, or attachment. This is essential for applications requiring compliance auditing, metadata extraction, or integration with MAPI-based systems. libpff supports both named and numeric property identifiers, and handles both 32-bit and 64-bit value types (e.g., strings, integers, binary blobs). Its tight integration with libfmapi ensures accurate interpretation of MAPI definitions, making it suitable for building advanced Outlook data analysis tools.

pff_item_t *message_item = NULL;
pff_property_t *property = NULL;
pff_error_t *error = NULL;

// Assume message_item is obtained from traversal
while (pff_item_get_property(message_item, &property, &error) == 1) {
    uint32_t property_tag = 0;
    uint32_t property_type = 0;
    const uint8_t *value_data = NULL;
    size_t value_data_size = 0;

    pff_property_get_tag(property, &property_tag, &error);
    pff_property_get_type(property, &property_type, &error);
    pff_property_get_value_data(property, &value_data, &value_data_size, &error);

    // Process property (e.g., print subject if PR_SUBJECT)
    if (property_tag == 0x0037001F) { // PR_SUBJECT (Unicode)
        printf("Subject: %ls\n", (wchar_t*)value_data);
    }
    pff_property_free(&property, NULL);
}

Export Data to Standard Formats (CSV, JSON, XML)

While libpff is primarily a C library for low-level parsing, it includes command-line utilities and APIs that facilitate exporting Outlook data to widely used formats like CSV, JSON, and XML. Tools such as `pffexport` can convert PST/OST contents into structured text files, preserving folder hierarchy and message metadata. Developers can also use the library programmatically to build custom exporters—e.g., mapping MAPI properties to JSON objects for ingestion into search engines or analytics platforms. This export capability is crucial for data migration, backup, and integration with modern cloud services that require standardized input formats. libpff’s flexible design allows developers to tailor export logic to specific compliance or workflow requirements.

# Export all messages to JSON with metadata
pffexport -f json -o output_dir/ example.pst

# Export only messages with attachments
pffexport -f json -a example.pst

# View help for export options
pffexport --help