<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing Email Forensics

## pffexport (libpff)

**Export Outlook PST/OST file contents.**

```bash
pffexport -m all -t eml evidence.pst
pffexport -m all -t text -f ./output/ evidence.ost
```

| Flag | Description |
|------|-------------|
| `-m` | Mode: `all`, `items`, `recovered` |
| `-t` | Output type: `eml`, `text` |
| `-f` | Output directory |

## readpst (libpst)

```bash
readpst -o ./output/ -r evidence.pst       # Recursive mbox output
readpst -o ./output/ -r -e evidence.pst     # Individual EML files
readpst -o ./output/ -S evidence.pst        # Separate files per folder
```

| Flag | Description |
|------|-------------|
| `-o` | Output directory |
| `-r` | Recursive folder extraction |
| `-e` | Output as individual .eml files |
| `-S` | Separate file per folder |

## ripmime

**Extract MIME attachments from email messages.**

```bash
ripmime -i evidence.eml -d ./attachments/
ripmime -i evidence.eml -d ./attachments/ --no-nameless
```

## opendkim-testmsg

**Verify DKIM signature on an email message.**

```bash
opendkim-testmsg < evidence.eml
echo $?  # 0 = DKIM pass
```

## extract-msg (Python)

```python
import extract_msg
msg = extract_msg.Message('evidence.msg')
print(msg.sender, msg.to, msg.subject, msg.date)
msg.save(customPath='./extracted/')
for attachment in msg.attachments:
    print(attachment.longFilename, attachment.data[:100])
```

## Python email stdlib

```python
import email, email.policy

with open('evidence.eml', 'rb') as f:
    msg = email.message_from_binary_file(f, policy=email.policy.default)

# Headers
msg['From'], msg['To'], msg['Subject'], msg['Date']
msg.get_all('Received')           # Delivery chain
msg.get('Authentication-Results') # SPF/DKIM/DMARC

# Attachments
for part in msg.walk():
    if 'attachment' in str(part.get('Content-Disposition', '')):
        filename = part.get_filename()
        payload = part.get_payload(decode=True)
```

## Python mailbox stdlib

```python
import mailbox
mbox = mailbox.mbox('evidence.mbox')
for msg in mbox:
    print(msg['From'], msg['Subject'], msg['Date'])
```

## DNS Authentication Records

```bash
dig TXT example.com              # SPF record
dig TXT _dmarc.example.com      # DMARC policy
dig TXT selector._domainkey.example.com  # DKIM public key
```
