Re: process for acquiring single mailboxes from exchange ser Posted: Fri Oct 06, 2017 1:33 am There was an excellent presentation at F3 at their 2015 conference about investigating Exchange, by a chap called Owen O'Connor. Tools like MrMAPI and MFCMAPI were demonstrated/discussed. The short version of the talk was that if you're just getting the OST/PST file then you are missing a huge amount of potentially useful & relevant stuff. I've just done a quick Google search and found this, which may be of interest: https://www.sans.org/summit-archives/file/summit-archive-1492187159.pdf https://github.com/stephenegriffin/mfcmap Hope this helps, Ben Project Description MFCMAPI provides access to MAPI stores to facilitate investigation of Exchange and Outlook issues and to provide developers with a sample for MAPI development. April 2017 Release of MFCMAPI and MrMAPI GitHub https://github.com/stephenegriffin/mfcmap