Microsoft Exchange

PFF (cf. summary from the Forensics Wiki [https://forensicswiki.xyz/wiki/index.php?title=Personal_Folder_File_(PAB,_PST,_OST)]) is a format exportable from Outlook and Exchange. Outlook makes use of this format for different scenarios, and calls them different names (.pst, .ost), but it is just one file type.

.pst files can be generated with Outlook interactively

.ost files can be taken from C:Users...

.pst files can be also generated from an Exchange Server's PowerShell in a mostly unattended fashion

Outlook interactive export

Once the Outlook main window is open, go to “File”, “Open & Export”, “Import/Export”:

Then follow the usual dialog chain.

Important

Before attempting to copy PFF files, ensure the file(s) is/are not open anywhere anymore. Even after closing Outlook, Outlook may still execute in the background for some seconds, in particular when the MAPI profile used Exchange Cached Mode. Various failure modes trying to access active PFF files have been observed, such as:

1. Under the cmd.exe shell, the command type stillactive.pst>new.pst produces new.pst with just 512 bytes before aborting with the message The process cannot access the file because another process has locked a portion of the file.

2. Under the cmd.exe shell, the command scp stillactive.pst a@b.com: can produce the file on the target, but all bytes are ASCII NUL bytes. (So observed with Powershell-OpenSSH v8.x; fixed in 9.x). A log message Domain error is output by scp.

3. PFF files contain a CRC-32 checksum, which can readily change while the file is in use. Attempts to read the file from underneath Windows (e.g. at the storage or hardware level), or attempting to use a PFF file that was not cleanly closed may result in gromox-pff2mt rejecting the input.

gromox-pff2mt import

On the grommunio system, PFF files can be imported on the command-line with gromox-pff2mt and gromox-mt2exm. These are two commands meant to be chained together by way of a pipe; tend to the linked manual pages to read about the invocation syntax.

Exchange PowerShell export

Contributors have written a PowerShell script [https://github.com/grommunio/gromox/blob/master/tools/exchange2grommunio.ps1] for the mass export of .pst files from an Exchange Management Console (a PowerShell instance with Exchange commands loaded) with a subsequent mass import via ssh commands that it issues. Inspect the first 130 or so lines of the script for mandatory adjustable parameters.

Generic Migration

This chapter covers overall migration to grommunio with generic and standardized protocols. These instructions are intentionally named generic, as these migration scenarios apply to multiple providers, installations and other communication software installations.

Individual emails

With the gromox-eml2mt, gromox-ical2mt, gromox-vcf2mt and gromox-mt2exm command-line utilities, grommunio has utilities with which individual emails, calendars or contact card files can be read and imported. Tend to the linked manual pages to read about the invocation syntax.

Migration via IMAP

As a user, you can do IMAP-to-IMAP transfers. This can be done interactively with a MUA such as Thunderbird or Alpine by having both the original and the Gromox IMAP accounts added and moving mails. Alternatively, the imapsync command-line utility may be used to do so non-interactively.

Kopano

On the grommunio system, Kopano databases can be imported on the command-line with gromox-kdb2mt [https://docs.grommunio.com/man/gromox-kdb2mt.8.html] and gromox-mt2exm [https://docs.grommunio.com/man/gromox-mt2exm.8.html]. These are two commands meant to be chained together by way of a pipe; tend to the linked manual pages to read about the invocation syntax.

Legal Notice

Amazon Web Services, AWS, AWS CloudFront, CloudFront, Elastic Compute Cloud, Amazon EC2, EC2, Elastic Load Balancer, ELB, and related graphics, logos, page headers, button icons, scripts, and service names are trademarks, registered trademarks, or trade dress of Amazon Web Services in the U.S. and/or other countries.

Apache and the Apache feather logo are registered trademarks of The Apache Software Foundation in the United States and other countries.

Azure, Azure Container Service, ACS, Azure Resource Manager, Windows, Windows Server, Active Directory, Active Directory Federation Services, Outlook and Microsoft are registered trademarks or trademarks of the Microsoft Corporation.

Debian is a registered trademark of SOFTWARE IN THE PUBLIC INTEREST, INC.

Docker is a registered trademark of Docker, Inc.

FreeBSD and the FreeBSD Logo are registered trademarks of The FreeBSD Foundation.

Google is a registered trademark, and Google Cloud Platform, Google Cloud Platform service, GCP infrastructure platform, Google Cloud enterprise services, and TensorFlow open-source software library are trademarks of Google LLC.

Grafana, Tempo, Pyroscope are trademarks of Raintank, Inc. dba Grafana Labs.

grommunio contains software provided by NGINX and its contributors. nginx is a trademark of Nginx Software, Inc.

HAProxy is a registered trademark of HAProxy Technologies LLC in the United States and France.

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both.

JavaScript, MySQL, and Oracle are trademarks or registered trademarks of the Oracle Corporation and/or its affiliates.

Jitsi is a trademark of 8x8, Inc.

Kubernetes is a graduated project of the Cloud Native Computing Foundation, or CNCF. Cloud Native Computing Foundation, CNCF, Kubernetes, K8s, Prometheus, and The Linux Foundation are registered trademarks of the The Linux Foundation. CNI and Spinnaker are trademarks of The Linux Foundation. Additional trademarks and registered trademarks can be found at https://www.linuxfoundation.org/trademark-list/.

Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

Mac, MacBook, and macOS are registered trademarks of Apple, Inc in the United States and other countries.

Matrix.org, Synapse are trademarks of Matrix.org Foundation C.I.C.

Mattermost is a trademark of Mattermost, Inc.

Nagios, the Nagios logo, and Nagios graphics are the service marks, trademarks, or registered trademarks of Nagios Enterprises, LLC.

NetBSD is a registered trademark of The NetBSD Foundation, Inc.

Nextcloud is a trademark of Nextcloud GmbH.

OpenID is a trademark (registered in numerous countries) of the OpenID Foundation.

ownCloud is a trademark of ownCloud GmbH.

Percona, XtraDB, Percona XtraDB, XtraBackup, Percona XtraBackup, Percona Server for MySQL, and Percona Live, plus the distinctive visual icons and logos associated with these marks are trademarks or registered trademarks of Percona LLC.

React, React Native, Facebook, Instragram and Meta are registered trademarks of Meta Platforms, Inc. ("Meta").

Red Hat, CentOS, RHEL, Red Hat Enterprise Linux are trademarks, or registered trademarks of Red Hat, Inc. or its subsidiaries in the United States and other countries.

Seafile is a trademark of Seafile Ltd.

Splunk is a registered trademark of Splunk, Inc. in the United States and other countries.

SUSE, openSUSE, YaST, Apparmor and their respective Logos are trademarks of SUSE LINUX AG.

The MariaDB® mark is a trademark of MariaDB Corporation Ab. The mariadb.org, MariaDB Foundation and MariaDB Server marks are exclusively licensed to the MariaDB Foundation.

Ubuntu and Canonical are registered trademarks of Canonical Ltd.

UNIX is registered trademark of The Open Group in the United States and other countries.

VMware vSphere, VMware vSAN, VMware vShield, VMware vCloud, VMware vRealize, VMware ESXi, VMware are registered trademarks of Broadcom, Inc. in the United States and other countries.

grommunio, the grommunio Logo and gromox are registered trademarks of grommunio GmbH.

All other trademarks, trade names, service marks, and companies referenced herein belong to their respective companies, foundations, or development communities.

Copyright 2020-2024 grommunio GmbH

Index