Anyone know how to successfully extract (as a standalone native file) a .msg file (OLE) embedded inside a .msg file (OLE) via the command line (Python preferred)? #DFIR
2
Replying to @JPoForenso
Have you tried @DidierStevens' oledump.py?

Apr 2, 2018 · 9:37 PM UTC

1
1
Replying to @hal_pomeranz @DidierStevens
Yep, but it just dumps the streams, which I can also do using the olefile library. I've yet to find something that will write the set of OLE streams from the .msg attachment out to a standalone OLE .msg file.
1
more replies