PST files are the personal storage data files that store user’s Outlook data. The PST files created in Outlook 2013 can store data up to the size of 50 GB.

1. Explore Outlook PST Data File!!

2. What is PST File?
 A PST file is a personal folder file in Microsoft Outlook.
 PST is an acronym for Personal Storage Table with the
file extension of “.pst”.
 In Outlook, the storage limit for a single user's .pst file is
2 GB till version 2002.
 PST file can also be used for archiving items from any
email account type via configuration.
 A POP3 type of email account — uses Outlook Data
Files (.pst).
 When Outlook items are saved in an Outlook Data File
(.pst), the items are available only on the local machine.

3. PST File – Quick Highlights
1. PST File does its programming tasks by using Outlook
Primary Interop Assemblies. These are a set of .NET
classes that provide a complete object model for
working with Microsoft Outlook.
2. Most .pst files use Unicode text, but some older
versions of Outlook create ANSI-based .pst files.
3. The PST file can be encrypted with a password to
protect the confidential information in it.

4. What's Oversized PST File Problem?
• Microsoft Outlook 2002 and earlier versions limit
the size of (PST) file to 2GB.
• Whenever the PST file reaches or exceeds that
limit, you will not be able to open or load it any
more, this is called oversized PST file problem.
• Microsoft Outlook 2003 put an end to this problem.
PST file created in it supports Unicode formatting
thus, doesn't have the 2GB size limit any more.

5. Structure Overview of PST
Messaging Layer
(msg store, folders, message, attachment)
List Table Layer
( Heap, BTree, Property Bags, Tables)
Node Database Layer
(Node database and Basic Storage)
 Logical Structure of PST File

6.  The Messaging layer has the logic to combine the
other two layers into folders, messages, attachments,
and properties.
 The Properties (LTP) layer is concerned primarily with
properties, which it stores in two-dimensional tables.
 The NDB layer includes the header, file allocation
information, and the nodes and blocks that hold
the message data, plus nodes that help locate that
data.

7.  Physical Structure of PST File
 Header
 Reserved Data
 Density List
 Allocation Map
 Page Map
 Data Section
 Free Map
 Free Page Maps

8. Header Structure:
It resides at the starting of the file & contains
information regarding-
 Metadata.
 Root record.
 Initial free map (FMap).
 Free page map (FPMap).

9. Reserved Data:
 Octets are reserved between the end of the header and
the beginning of the Density List(DLIst).
 This part is reserved for future expansion of the PST file
Header structure.
Density List (DList):
 Consists of an ordered list of references to (AMap).
 Optimize the space allocation so that space referred to
pages with the most abundant free space is allocated
first.
 One DList in the PST, which is always located at a fixed
offset in the PST file.

10. Allocation Map (AMap):
 It tracks the allocation status of the data
section that follows the AMap page in the file.
 Here user can view the complete AMap page
as an array of bits, where each bit corresponds
to the allocation state of 64-bytes of data.
 An AMap page appears approximately after
every 250 KB in the .pst file.

11. Page Map(PMap):
 Block of data that is 512 byte in size.
 It generally stores metadata in the PST.
 Optimizes the search of available page.
 PMap roughly appears after every 2 megabytes.
Data Section:
Group of Data that is 250 Kbytes contains allocation.
Each allocation have align of 64-byte boundary and is in
size that are multiples of 64 bytes.

12. Free Map(FMap):
 Provides a mechanism to quickly locate contiguous free
space.
 Each byte in the FMap corresponds to one AMap page.
 FMap contains the maximum amount of contiguous free
space in that AMap up to about 16 kilobytes.
Free Page Map(FPMap):
 It is used to quickly find free pages.
 FPMap page covers about 8 gigabytes of space.

13. Vital Role of PST File in Digital Forensics
 With the increase in e-mail scams and fraud attempts
with phishing and spoofing:
• Investigators need to know how to examine and carve
evidence from e-mail message.
• Examine evidence from emails is the motive to
introduce a whole new range of analysis solutions in
"Digital Forensic"
• Since Outlook Data file are in .pst file format, here
investigators use some renowned tool to examine
such files.
 If you want more info for the same just go through the
given link:
http://www.xploreforensics.com/pst-file-forensics.html