Case shape: Mid-market Canadian professional services firm (~85 employees). Insurance litigation matter involving contested vendor contract terms. Custodian executive OST file transferred to eDiscovery vendor for extraction. Transfer truncated at 40 GB despite header declaring 65 GB total. Discovery period covered 18 months of custodian mail. Sherlock pre-1.4.0 tooling and EnCase and Cellebrite Physical Analyzer all failed initial validation on the truncated file. Investigation stalled two weeks pending vendor re-acquisition negotiation. Sherlock PST Viewer 1.4.0 salvage reconstruction recovered 89 percent of surviving messages including the specific date range the litigation depended on.
The Original Transfer Failure That Started Everything
The custodian executive's Outlook OST file was captured by the client IT team from the executive workstation prior to eDiscovery vendor engagement. The transfer to the vendor happened via secure file transfer with a documented chain of custody. The vendor received the file and began the standard ingest workflow. On first load into the vendor's PST processing tool the file returned a header-inconsistency error: the OST header declared 65 GB of expected content and 87000 estimated messages but the file on disk was 40 GB in size with the internal B-tree index absent or truncated.
The vendor escalated to their technical team for salvage attempt. Standard tooling in the vendor's arsenal (a combination of EnCase EnScript modules, Cellebrite Physical Analyzer PST plug-in and scanpst.exe repair utility) all failed to process the file. Each tool's failure mode was different but the outcome was the same: no messages extracted. The vendor's escalation report to the client characterized the file as unrecoverable and requested re-acquisition from the source device.
Re-acquisition was not straightforward. The custodian executive had left the firm during the discovery period. The executive's workstation had been reassigned to another employee and wiped per standard IT decommission process approximately three months before the litigation matter surfaced. The original OST file existed only in the vendor's possession as the truncated 40 GB copy. The client IT team had no backup of the pre-decommission workstation state that would allow re-acquisition.
The Two-Week Stall
Investigation activity stalled for two weeks while client counsel and vendor counsel and the vendor technical team negotiated the path forward. Options considered included: engaging a specialized data recovery vendor with proprietary PST forensic tooling (quoted at $18000 and 3 to 4 week engagement window), abandoning the truncated file and proceeding with alternative-source discovery (server-side Exchange retention and other custodian mailboxes) and escalating the matter to court for potential adverse inference against the party responsible for the acquisition failure.
None of the options were satisfying. The specialized data recovery engagement carried acknowledged risk that reconstruction might still fail and added billable weeks to an already delayed matter. Abandoning the truncated file left the responsive discovery incomplete because the executive custodian's mail was central to the contested contract terms. Court escalation risked broader consequences for the vendor and for client counsel and was not proportional to a technical acquisition failure that all parties agreed was accidental.
Two weeks into the stall the client counsel engaged Sherlock Forensics for independent second-opinion assessment of the truncated file. The engagement scope was narrow: assess whether any reconstruction was feasible with contemporary tooling and document the reconstruction methodology if any output was recoverable.
What Sherlock PST Viewer 1.4.0 Actually Did
The Sherlock engagement examiner loaded the 40 GB truncated file in Sherlock PST Viewer 1.4.0. The tool immediately produced a diagnostic on load: header declares 65 GB total content and 87000 estimated messages, file on disk is 40 GB, internal B-tree index missing beyond offset 38 GB, salvage reconstruction available. The diagnostic was structured and specific and matched exactly what the vendor's tooling had reported as a fatal error.
The Sherlock PST Viewer 1.4.0 salvage reconstruction operates by walking the intact data pages that precede the truncation boundary and rebuilding the folder tree and message set from surviving MAPI records. The reconstruction runs read-only on the source file: the tool does not modify the truncated PST. The output is a new reconstructed PST that contains every message the salvage was able to recover and a diagnostic manifest documenting which messages recovered and which are absent from the reconstruction (identified by the missing folder or missing message reference in the surviving pages).
Reconstruction of the 40 GB truncated file completed in approximately 4.5 hours on standard forensic workstation hardware. The output was a 34 GB reconstructed PST containing 77400 messages out of the 87000 estimated total = 89 percent recovery. The 10800 unrecovered messages were identified as belonging to specific folder identifiers (predominantly the Sent Items folder for the final two months before the truncation boundary) which allowed the examiner to characterize the gap for the litigation record.
What the Recovered Messages Contained
The recovered message set covered the full 18 month discovery period and included the specific date range the contested contract terms were negotiated across. The Sent Items messages that fell in the unrecoverable 10800 message gap were assessed for materiality and determined to be predominantly automated notifications and routine confirmations rather than substantive negotiation correspondence. The contract-negotiation messages themselves were fully recovered from the Inbox and Sent Items folders whose data pages preceded the truncation boundary.
Cross-correlation against the client's server-side Exchange retention (which held a partial subset of the mailbox that predated the migration to the executive workstation profile) confirmed that the reconstructed messages matched the corresponding server-side records byte-for-byte for the overlapping period. This corroboration established the reconstruction accuracy and supported the evidentiary chain of custody documentation the litigation subsequently required.
The Chain of Custody That Made the Salvage Court-Defensible
The Sherlock reconstruction chain of custody documented every step from receipt of the truncated file through the salvage reconstruction and the output PST hash record. The documentation established: receipt hash of the 40 GB truncated file, examiner identity and timestamp, tool version (Sherlock PST Viewer 1.4.0 build reference), diagnostic report contents, reconstruction command and parameters, output PST hash, per-message hash for every recovered message and the reconciliation against server-side Exchange retention.
Opposing counsel challenged the salvage output at deposition. The Sherlock examiner walked through the chain of custody documentation, the diagnostic methodology, the salvage reconstruction algorithm (walking intact data pages and rebuilding folder tree from surviving MAPI records read-only) and the cross-correlation validation against server-side records. The deposition established the salvage output as authentic reconstructed evidence and the litigation proceeded on the reconstructed message set as the discovery record.
The two-week stall and the specialized-vendor $18000 quote were both avoided. The Sherlock engagement cost for the salvage-plus-reconstruction-plus-chain-of-custody documentation was significantly below the alternative. More importantly the discovery timeline recovered and the matter continued without either court escalation or the adverse consequences that would have followed.
What This Case Establishes About Damaged PST Recovery in 2026
The case establishes several patterns that recur in insurance and commercial litigation matters where PST evidence is central. First, transfer truncation is not rare. Large PST files transferred across networks and storage boundaries and vendor handoffs routinely encounter truncation that surfaces only at ingest time. Second, the mainstream tooling (EnCase and Cellebrite and scanpst.exe) declines files that fail initial header-plus-index validation. Vendors that rely exclusively on the mainstream toolchain hit dead ends on damaged files. Third, salvage reconstruction from valid header and intact data pages is technically feasible when the tool implements the walk-plus-reconstruct methodology; it was not previously packaged in a customer-accessible tool.
Sherlock PST Viewer 1.4.0 makes this salvage capability accessible to any investigator handling PST evidence. The tool ships with damaged-PST salvage as a standard capability. The free tier receives the diagnostic and a Forensic Edition upgrade prompt. The Sherlock PST Viewer Forensic Edition performs the reconstruction. Read-only on the evidence file. This is a genuine differentiator versus EnCase, Cellebrite and AXIOM which typically decline to process files that fail initial validation.
The Operational Discipline This Case Suggests
For organizations handling PST evidence at scale the operational discipline this case suggests is straightforward. First, do not accept vendor "unrecoverable" determinations on damaged PST files without independent second-opinion assessment. Vendors that lack salvage reconstruction capability will decline files that a salvage-capable tool would recover. Second, request formal diagnostic output when a PST fails ingest. The specific failure mode (header truncation versus index corruption versus body truncation) determines whether salvage reconstruction is feasible. Third, build salvage-capable tooling into the standard forensic acquisition and review workflow so damaged-file scenarios do not stall investigations while alternatives are negotiated.
For Sherlock customers the Sherlock PST Viewer at Forensic Edition tier handles the salvage capability end-to-end. For organizations preferring engagement rather than internal capacity the Sherlock incident response engagements apply the same methodology as part of the standard PST-forensic scope. The methodology stays consistent regardless of who runs the tooling.
The two-week stall this case suffered was avoidable with contemporary salvage-capable tooling in the vendor's arsenal. That tooling now exists as a shipping product. The next damaged-PST scenario at the next client should not require a two-week negotiation before reconstruction begins.
The insurance litigation matter itself settled several months after the salvage reconstruction produced the discovery record. Neither party attributed the settlement to the reconstructed evidence specifically but the client counsel indicated the ability to produce comprehensive discovery from what had appeared to be an unrecoverable source materially strengthened the negotiating position. The reconstructed PST and the associated chain of custody documentation are preserved as part of the matter closure record per the client's document retention and regulator obligations.