What is the standard email forensic toolkit?

A defensible email forensic examination toolkit needs to handle four Microsoft formats: PST (Outlook mailbox archives), OST (cached Exchange or Microsoft 365 mailboxes including orphans), MSG (single Outlook items) and EML (the RFC 5322 internet standard used by e-discovery review platforms). Each requires read-only examination with SHA-256 hashing at intake, per-artifact hashing at extraction, chain of custody logging and court-ready PDF report output. Sherlock Forensics PST Viewer Forensic Edition at $67 lifetime handles all four formats in a single tool.

How do I examine PST and MSG files in a single workflow?

Use a tool that opens both formats with the same forensic discipline. Sherlock Forensics PST Viewer Forensic Edition reads PST, OST, MSG and EML files via the same custom parser. The workflow is identical regardless of source format: open read-only, browse or filter within case scope, extract to EML with preserved folder hierarchy, generate the forensic PDF report with chain of custody footer. For high-volume MSG-only examinations such as Bates-stamped exhibit review, Sherlock Forensics MSG Viewer Forensic Edition at $67 optimizes the MSG-specific workflow.

Do I need separate tools for PST and EML?

No. A single tool that handles both formats with consistent forensic output is preferable to switching between products. Sherlock Forensics PST Viewer Forensic Edition reads PST, OST, MSG and EML files in one tool. The output format is also unified: extraction from any source format produces EML directories with preserved folder hierarchy, ready for ingestion into e-discovery review platforms. Avoiding tool-switching reduces chain of custody breaks and simplifies the production set.

What format do e-discovery review platforms accept?

EML with preserved folder hierarchy is the e-discovery standard. Relativity, Logikcull, Concordance, Reveal and Everlaw all ingest and export EML natively. When the source artifacts are PST or OST or MSG, the standard workflow is to export to EML directories first and then ingest the EML output into the review platform. Sherlock Forensics PST Viewer Forensic Edition exports all supported formats to EML with folder hierarchy preserved, which is what review platforms expect.

Email Forensics Toolkit: PST, OST, MSG and EML Examination

Corporate email investigations rarely involve a single file format. A typical engagement surfaces a custodian's mailbox archive as a .pst, supplemental orphan caches as .ost from decommissioned workstations, individual exhibits as .msg files dragged out of Outlook and review-platform productions as .eml directories. The competent examiner needs tooling for all four.

This guide covers the integrated workflow for examining Microsoft email artifacts across the four common formats. It applies whether the matter is a litigation production, an internal investigation, an HR matter, an M&A diligence pass or a regulatory inquiry.

The Four Formats and When Each Shows Up

PST (Personal Storage Table), the most common email artifact in corporate cases. A complete Outlook mailbox in a single file. Shows up as: custodian's exported mailbox, archive of an old mailbox kept after migration, backup of a personal Outlook installation, produced artifact in litigation.

OST (Offline Storage Table), Outlook's cached copy of an Exchange or Microsoft 365 mailbox. Shows up as: terminated employee's workstation acquisition, decommissioned server's orphan caches, forensic acquisition of a workstation. Often the only surviving copy when the server side is gone.

MSG (Outlook Message), a single Outlook item saved as an individual file. Shows up as: emails forwarded as attachments preserving original headers, Bates-stamped exhibits in productions, individual messages saved out of a mailbox.

EML (RFC 5322 internet mail), the e-discovery review platform standard. Shows up as: productions from opposing counsel, exports from non-Microsoft mail clients (Thunderbird, Apple Mail), output from Microsoft email tools when configured for portable format.

A single matter may involve all four. A litigation production for a former employee might include: their .pst archive (mailbox at termination), their .ost orphan (workstation cache after their M365 account was deleted), several .msg exhibits from specific high-relevance messages and an .eml production of the privilege-reviewed subset delivered to opposing counsel.

The Forensic Requirements Common Across Formats

Every email-artifact examination in an evidentiary context shares the same requirements:

Source artifact hash at intake. SHA-256 of the file as received. Timestamp, examiner identity, source path.
Read-only examination. The source file must not be modified during examination. The hash before and after operation must match.
Per-artifact extraction hash. Each message, attachment, contact and calendar item hashed independently at extraction.
Chain of custody documentation. Operations performed, by whom, when, with what tool. Output destinations.
Defensible export format. EML with preserved folder hierarchy is the e-discovery review-platform standard.
Court-ready forensic report. Branded PDF with cover page, source metadata, hash verification table, examiner attestation, chain-of-custody footer.

These requirements do not change based on which format the source artifact uses. The tooling has to support each format with the same forensic discipline.

The Sherlock Forensics Email Toolkit

Sherlock Forensics handles all four formats across two products at the $67-each tier:

Sherlock Forensics PST Viewer Forensic Edition ($67 lifetime) reads PST (ANSI and Unicode), OST (orphan and active), MSG and EML files. Custom Rust parser, no Outlook installation required. Forensic-grade output with SHA-256, chain of custody, court-ready PDF reports, SMTP transport chain visualization, SPF/DKIM/DMARC authentication results.

Sherlock Forensics MSG Viewer Forensic Edition ($67 lifetime) is built specifically for high-volume single-message MSG examination. Same forensic discipline as the PST Viewer, optimized workflow for the MSG-specific use case (Bates-stamped exhibit review, batch-MSG production analysis, single-message investigations).

For most corporate-forensic practices, the PST Viewer alone covers all four formats. The MSG Viewer adds value when the matter is MSG-heavy: an HR investigation where evidence arrives as a folder of .msg files saved by the reporting party, an e-discovery production where the opposing counsel exported messages individually rather than as a full mailbox or a fraud investigation where specific messages were preserved out-of-band by the custodian.

For practices handling multiple matters per year with MSG-heavy patterns, both products at $134 total covers every Microsoft email format with no functional gap.

Cross-Format Workflow

The integrated workflow that operates across all four formats:

Intake every artifact with SHA-256. Hash everything received. Document source, custodian, date, examiner.
Examine each artifact in the matching Sherlock tool. PST/OST/EML in the PST Viewer Forensic Edition. MSG files in either tool depending on volume and use case.
Filter to case scope. Date ranges, custodians, keywords, sender/recipient as authorized by the examination protocol.
Extract to EML with preserved folder hierarchy. This is the universal output format for downstream review-platform ingestion. Both Sherlock products produce this format.
Generate the forensic PDF report. One per source artifact. Court-ready, branded, includes the chain of custody footer.
Bundle the production set. EML directory tree + signed JSON chain-of-custody sidecar + forensic PDF reports per source artifact + administrative documents (cover letter, load file, privilege log placeholder).
Deliver via approved channel. SFTP, encrypted USB in person, secure managed file transfer. Email of PHI or PII as attachments is not an approved channel without specific encryption.
Retain source artifacts indefinitely in cold storage with documented chain. The source artifacts may be requested back years later for unforeseen reasons.

The workflow is the same regardless of how many of the four formats the matter involves. The Sherlock products produce compatible output across formats, an examination that combines PST and EML and MSG artifacts generates one unified production set rather than three incompatible deliverables.

Format-Specific Considerations

A few format-specific details that affect the workflow:

For PST files: Both ANSI (Outlook 2002 and earlier) and Unicode (Outlook 2003+) variants exist. The Sherlock parser routes by the file header's wVer field. Encrypted PSTs are detected but cannot be examined without the password.

For OST files: The file is tied to a specific Outlook profile. Orphan OST (no live profile, no live Exchange) requires a tool that opens the file independently. Sherlock does this.

For MSG files: A single .msg may contain attachments that are themselves .msg files (forwarded messages preserving the original Outlook item). Recursive extraction may be needed; both Sherlock products handle this.

For EML directories: When the production from opposing counsel arrives as an EML directory tree, the folder structure is part of the evidentiary metadata. Importing the tree into the review platform must preserve the folder hierarchy or the metadata is lost.

Beyond Email : The Broader Sherlock Forensics Toolkit

Email forensics is one capability within the broader Sherlock Forensics toolkit. Adjacent forensic tools at similar price tiers:

Sherlock Forensics Universal Events Viewer Forensic Edition ($97), Windows event log triage and incident response analysis
Sherlock Forensics NSF Viewer Forensic Edition ($297, launching), Lotus Notes archive examination with the same forensic discipline
Sherlock Forensics Browser Viewer Forensic Edition ($29), Browser history, bookmarks, downloads forensic extraction
Sherlock Forensics Android Acquirer Forensic Edition ($399), Android logical acquisition with court-ready reports

For practices handling diverse forensic engagements, building the Sherlock toolkit incrementally as cases require is typically more economical than purchasing enterprise tools at the $5,000-$20,000+ tier.

Cost Comparison Across the Toolkit

Capability	Sherlock	Comparable enterprise tool
PST examination with chain of custody	$67 (lifetime)	$5,000-$20,000/year
MSG examination at scale	$67 (lifetime)	Bundled in enterprise email forensic suite
Windows event log incident response	$97 (lifetime)	$1,000-$5,000/year for SIEM-adjacent tools
Lotus Notes archive forensics	$297 (lifetime, launching)	$5,000+ for enterprise NSF tools
Android logical acquisition	$399 (lifetime)	$5,000-$20,000+ for Cellebrite UFED, MSAB
Browser forensic extraction	$29 (lifetime)	Bundled in enterprise IR suites

For a corporate forensic team running 10-50 cases per year across diverse evidence sources, the full Sherlock toolkit at under $1,000 lifetime delivers the same forensic-grade output as enterprise tools that cost five-figures per year.