The short answer: Yes. The OST file lives on the user device and survives server-side mailbox deletion. Modern Outlook stores OST at %LOCALAPPDATA%\Microsoft\Outlook\ as username@domain.com.ost. The orphaned file is readable by purpose-built OST forensic tools without requiring connection to the original Exchange server.
How OST Differs From PST
PST and OST are both Microsoft mail store formats but they serve different roles. PST is a portable mail archive: it is created when a user manually exports their mailbox or when Outlook is configured for POP3-only delivery. PST files travel with the user and contain a complete self-contained mailbox copy. OST is the offline cache that synchronizes with Exchange: Outlook maintains the OST so that users can read mail and draft replies when the device is disconnected from the corporate network. OST cannot be opened by Outlook on a different device because it is tied to the original Exchange profile.
The forensic implications are different. PST files are designed to be portable and Outlook will open a PST given the file alone. OST files are tied to the original Exchange mailbox profile and cannot be opened by a fresh Outlook installation without elaborate profile reconstruction. This is the gap that forensic OST tooling fills: the Sherlock OST Viewer reads OST files directly without requiring the original Exchange profile or any active Exchange connection.
What Survives When the Server-Side Mailbox Is Deleted
When an Exchange administrator deletes a user mailbox several things happen on the server side: the mailbox is moved to the Recoverable Items folder, retention policies start counting down to permanent purge, audit logs record the deletion. On the client side, nothing happens until the next Outlook startup. At that next startup Outlook attempts to authenticate against the now-missing mailbox, fails and displays an error to the user. The OST file on disk is untouched by the server-side delete: it sits in the same location with the same contents as the last successful sync.
The OST contents at the moment of last sync are what an investigator can recover. For a user who used Outlook actively before their mailbox was deleted, the OST contains all email, calendar items, contacts, tasks and public folder cache that was synced through Outlook. For a user who had Outlook closed for an extended period before their mailbox deletion, the OST contains the last-sync state and is silent on activity after that point.
The Recovery Workflow
The recovery workflow begins with forensic acquisition of the client device. Modern Outlook profiles store the OST under %LOCALAPPDATA%\Microsoft\Outlook\ with a filename of the form username@domain.com.ost. Image the device or extract the OST file and the surrounding profile metadata into a forensic working directory. Hash the source file before any analysis and document the chain of custody from the moment of acquisition.
The Sherlock OST Viewer opens the file directly: no Exchange profile reconstruction required, no server connection, no Outlook installation. The tool reads the OST internal structure (folders, messages, attachments) and exports to PST, MSG, EML or PDF as needed for downstream review. The export step preserves the original metadata (sent dates, recipients, headers) which is critical for litigation evidentiary value.
Legal Considerations for Departed-Employee OST Recovery
OST recovery from a departed employee device is generally legal in Canada under acceptable use policy provisions that most organizations include in employment agreements. The legal posture is strongest when three conditions hold: the organization owns the device, the acceptable use policy discloses the organization right to inspect device contents and the recovery is undertaken for a documented business purpose. Litigation contexts add a fourth condition: the preservation needs to be documented through a litigation hold notice issued at the time of the triggering event.
For organizations operating in Quebec, Law 25 adds an additional consideration around personal information and the privacy interest of the departed employee. The Sherlock Quebec Law 25 Compliance Deep Dive walks through the territorial scope rules and the breach notification framework that applies when forensic activity surfaces personal data. PIPEDA applies to all federally regulated employers and to all provincial private-sector organizations outside Quebec, Alberta, BC and Newfoundland.
What Sherlock Customers Get Out of OST Recovery
Departed-employee investigations, post-incident mailbox reconstruction work and litigation hold preservation are the three most common Sherlock OST Viewer use cases. The tool is purpose-built for the specific problem of opening an orphaned OST without Exchange or Outlook. Output formats match downstream review tooling: PST for Relativity ingest, MSG for native review, EML for cross-platform review and PDF for static evidence packaging. Pricing and product detail is on the Sherlock OST Viewer storefront.
The key thing to understand is that the OST exists on the device whether or not the organization actively planned for its recovery. Building the operational discipline to acquire OST files at the moment of employee separation or device decommission turns a reactive forensic effort into a routine business process.