Outlook Spy

Outlook Spy is a developer tool for MS Outlook that you can install as an add-in. Download it here: http://dimastr.com/outspy/home.htm .

If you select a message, and then click on iMessage, and then do the same for another message you'll be to compare them and detect any differences.

If you click on the Compare tab for one message, and then drag over the PR_ENTRYID field from the other message on to this tab . . .

. . . .click on Show Properties . . . different on this object, and the fields which are different on first message will be displayed.

Opening winmail.dat files

It's common to find attachments in Outlook email messages which are named 'winmail.dat'. Rich text and attachments can be extracted from this files with the help of EOL Soft's Winmail Opener.

In this example from the EDRM Enron Email Data Set we have an email with a small 4 KB .dat file attached. The inclination might be to ignore it, as non-convertible formatting detail from another message.

However if we simply save this attachment to a local drive and then browse and open it with Winmail Opener . . .

. . . . a quite substantive message is revealed. In this example, if we read down further in the thread, we see that the Enron employees recognized the problem with the winmail.dat attachment, and restored to faxing the message instead.

This problem arises when a winmail.dat file is used by Outlook to preserve rich text formatting, but changes made during transport prevent the receiving client from recognizing it.

Cracking Outlook .pst archive file passwords

The password encryption method used by Outlook for .pst archive files is not very sophisticated. Nirsoft has a free utility that can crack the password for these files if you come across them during collection and the custodian has either forgotten, or is not available to provide the password.

As you see the PstPassword utility actually generates three different passwords. One of these passwords will open the .pst archive, and none of them is the same as the password the user originally created for the archive. The documentation says that "This utility can recover the PST passwords of Outlook 97, Outlook 2000,Outlook XP, Outlook 2003, and Outlook 2007", but I tested it tonight and it can also detect .pst file passwords created with Outlook 2010. It will not generate passwords for Outlook 2016 .pst archives.