Does anyone know if there is a way to extract Outlook emails with attachments from memory? What I have tried is to use volatility to dump PST files from memory and then use libpff to recover the attachments from PST files, but for some reason, libpff could not recover the attachments with contents (I only got an empty file).
Does anyone have any advice about how to use libpff with other tools to extract email attachments from memory?
