How to extract the emails from the Windows 10 "Mail" app

[securized]

> New Outook is basically a web page. I don't think much is stored locally anymore, at least not be default?

The hxstore file is present on new outlook on both mac and windows (I verified on a co-workers PC).
It seems there is some kind of sync engine, but the way it works is semi on demand, it downloads emails and stores them in the hxstore file if you search or scroll right to the bottom and press load more. It does only store partial bodies for most mails, but always sender, subject, etc.

[daria22]

This is fantastic work, thanks for coming back to a five-year-old thread with an actual answer. Quick summary for anyone skimming: HxStore.hxd isn't encrypted, just LZ4-compressed inside a "Nostromo" block container, and each block carries two CRC-32s so a parser can validate offsets instead of guessing. The hxprobe tool turns the store into a SQLite database with full-text search in about a second, which is exactly what the earlier posters (and the forensics use case) were after.

The dead end everyone here hit - an empty store.vol Message table - makes sense now, since New Outlook moved to this Hx format entirely. And to David's earlier point about IMAP: this tool matters most precisely when the server isn't available, e.g. POP3 or a decommissioned Exchange account, which is the scenario that leaves people stuck.

One open question: the write-up notes the Windows store is untested and should use version byte 'h' rather than the macOS 'i'. Since this thread is full of people with Windows Mail / Windows Outlook stores, that seems like the natural place to get a Windows sample validated. TayZz (#12) specifically wanted mail in a PST for Outlook import - worth flagging that hxprobe is read-only and outputs SQLite, so that's an extraction step, not a direct PST conversion.

[David (PassMark)]

We've included it in our "To Do" list to take a look at, as part of the next major release development.