search

libyal / libpff

Library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format
GNU Lesser General Public License v3.0
289 stars 74 forks source link

Python: invalid pst file signature #76

Closed Elmetayer closed 5 years ago

Elmetayer commented 5 years ago

Hi,

I'm using libpff Python on Mac OS, and I'm trying to open a pst file archive that I've created on my work PC. I get the error below, do you have any idea where this could come from ?

OSError Traceback (most recent call last)

in () 1 pff_file = pypff.file() ----> 2 pff_file.open("Mail/Archive mails 20140818.pst", mode="r") 3 pff_file.close() OSError: pypff_file_open: unable to open file. libpff_io_handle_read_file_header: invalid file signature. libpff_file_open_read: unable to read file header. libpff_file_open_file_io_handle: unable to read from file handle. libpff_file_open: unable to open file: Mail/Archive mails 20140818.pst. Thanks !
joachimmetz commented 5 years ago

can you hexdump the first 64 bytes of the pst? the library is telling you it cannot find the format signature it expects. A common issue with pst files are copy errors.

Elmetayer commented 5 years ago

Here it is:

0000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000040

joachimmetz commented 5 years ago

yeah, as I suspected. The data is corrupt and technically not a PST file.

Elmetayer commented 5 years ago

Thanks ! this is strange, it was created as an archive in outlook as the rest of my pst files (which are processed ok), and is still readable in outlook

joachimmetz commented 5 years ago

Likely an I/O sync error. This happened frequently to me in the past on Windows, likely a remove-able media sync did not happen before disconnecting.

and is still readable in outlook

are you sure the empty file is readable by outlook? or are you looking at the original?

Elmetayer commented 5 years ago

Yes it’s readable as the others I have ... I’ll create again this archive

joachimmetz commented 5 years ago

Strange since MS-PST states:

dwMagic (4 bytes): MUST be "{ 0x21, 0x42, 0x44, 0x4E } ("!BDN")"
TonyD-evOps commented 3 months ago

Hi,

I have a PST file (20Go) that is completely corrupted. The first 64 bytes of the header are 00 even the rest of the file. I would like to know if it could be possible to add dwMagic and the help of some kind of "magic tool" to rebuild the file or will it be impossible and the file is dead.... ?

Thank you !

joachimmetz commented 3 months ago

@TonyD-evOps this is NOT a PST file, this is 0-byte data, which basically means you have no PST data.

TonyD-evOps commented 3 months ago

But the file indicates a size of 20Go in the explorer ....

joachimmetz commented 3 months ago

But the file indicates a size of 20Go in the explorer ....

And your point is? 20 GiB of 0-byte values are 0-byte values not PST data