Digital Forensics · · 7 min read

Orphan OST Forensic Examination: The Practitioner's Guide

OST Forensics Ex-Employee Cases Chain of Custody

An orphan OST is an Outlook offline cache file whose originating Exchange account no longer exists. The cache file remains on the user's workstation as a complete mailbox snapshot but cannot be opened by Outlook without the original account. Forensic examination requires a direct-from-disk parser. Sherlock Forensics OST Viewer Forensic Edition at $67 lifetime handles the orphan-OST workflow with full chain of custody.

OST files are Outlook's offline cache. They live on the user's workstation, mirror the user's Exchange mailbox and survive long after the Exchange account is gone. When an employee leaves and IT decommissions their Microsoft 365 account, the OST file on their old workstation is often the only complete copy of their email that remains under the company's direct control.

This is the forensic scenario the orphan-OST examination workflow addresses: a workstation with an OST file but no working Exchange connection, no Outlook profile that can open the file natively and a case that depends on the email content inside the OST.

This guide is the practical workflow for forensic examination of orphan OST artifacts using the Sherlock Forensics OST Viewer Forensic Edition. Built for forensic examiners, e-discovery analysts, paralegals and HR-investigation teams handling separated-employee email evidence.

What Makes OST Different From PST

PST and OST are both Outlook personal-storage formats sharing the same underlying PFF (Personal Folder File) structure. The difference is operational, not structural:

PST is the user-authored archive. The user explicitly chose to export or archive email into a PST. It is a self-contained mailbox snapshot the user owns.

OST is the offline cache. Outlook creates and maintains it automatically when a mailbox is configured in cached-mode. It mirrors the Exchange-side mailbox content. When the Exchange-side account exists, OST can be re-synced or re-cached. When the Exchange account is gone, the OST becomes an orphan: a complete mailbox snapshot with no upstream authority to validate against.

For forensic purposes the orphan OST is often MORE valuable than a PST. Users frequently delete from their PSTs or selectively archive. The OST, being an automatic cache, mirrors what was actually in the Exchange mailbox at the cache's last sync point. That includes items the user thought they deleted (Recoverable Items, Deletions folder retention), items they may have hidden via search filters and the full Sent and Drafts state.

The Three Failure Modes of Orphan OST Examination

When an examiner first encounters an orphan OST, three failure modes commonly block the workflow:

Failure 1: Outlook cannot open the OST without the originating Exchange account. Modern Outlook (2019, 2021, 365) refuses to open an OST file unless it can validate the file against a connected Exchange mailbox. The OST is encrypted with a profile-bound key that requires the original account context. Opening the OST in any other Outlook profile produces an error and a refusal.

Failure 2: Microsoft does not ship an OST-to-PST conversion tool. ScanPST.exe handles PST repair, not OST. Older Microsoft-provided OST conversion utilities have been removed from current Office distributions. The standard recovery path no longer works.

Failure 3: Hardware write blockers do not solve the orphan-OST problem. A write-blocked OST is still an OST that cannot be opened by Outlook without the original account. The blocker preserves the evidence; it does not produce a readable artifact.

The forensic answer is a tool that opens the OST directly from disk without requiring Exchange, without requiring Outlook and without requiring the original profile. Sherlock Forensics OST Viewer Forensic Edition is that tool for the orphan-OST examination workflow.

What Orphan OST Examination Produces

For each orphan OST in an investigation, the forensic examination produces:

Source OST SHA-256 hash at intake. Recorded with the evidence-collection date, chain of possession and examiner attestation.

Folder-tree reconstruction. Inbox, Sent Items, Deleted Items, Drafts, Calendar, Tasks, Contacts plus custom user-created folders surfaced from the OST structure. Folder hierarchy preserved.

Per-message extraction with metadata layer. Every email surfaced with sender, recipient list (To/CC/BCC), subject, body, attachments, transport headers (Received chain when present), MAPI properties (PR_CREATION_TIME / PR_LAST_MODIFICATION_TIME / PR_CLIENT_SUBMIT_TIME / PR_MESSAGE_DELIVERY_TIME / PR_CONVERSATION_INDEX). Per-message SHA-256 for chain of custody.

Deletion-recovery layer. Items in the Deleted Items folder surfaced. Items in the Recoverable Items folder (the post-deletion retention area that survives Empty-Deleted-Items for the Exchange-policy retention window) surfaced. Per-item examination of whether the item was user-deleted vs Exchange-retention-expired.

Attachment inventory with per-attachment SHA-256. Every embedded attachment hashed independently and tied back to the source OST hash through the chain log.

Forensic PDF report. Court-ready, branded "Sherlock Forensics OST Viewer Forensic Edition" per the buyer's purchase surface, includes all the above with chain-of-custody footer and examiner attestation.

The full examination workflow runs through the OST Viewer Forensic Edition in a single tool pass per OST file or batched against a directory of OST files. At $67 lifetime, the cost per orphan-OST examination is under $1 amortized across the typical 3-5 year forensic-practice horizon.

The Ex-Employee Separation Use Case

The highest-volume orphan-OST scenario is the ex-employee separation case. Pattern:

  • Employee X leaves the company (resignation, termination, restructuring)
  • IT decommissions Employee X's Microsoft 365 account within 30-90 days per company policy
  • Employee X's workstation goes into HR custody for re-imaging
  • Before re-imaging, the forensic examiner extracts the OST from %LOCALAPPDATA%\Microsoft\Outlook\ on the workstation
  • The Exchange-side mailbox is gone; the OST is the only artifact remaining under company control
  • Case scope determines what the examiner does with the OST: full content review, targeted keyword search, attachment inventory, deletion-pattern analysis

For separation cases tied to potential litigation (wrongful-termination claims, trade-secret theft investigations, harassment allegations, IP-misappropriation suits), the orphan OST is often the load-bearing evidence. Without it the case is purely testimonial.

Sherlock Forensics OST Viewer Forensic Edition handles this workflow as its primary use case. The tool opens the orphan OST directly, surfaces the full mailbox content with chain-of-custody preservation and per-message hashes and produces the forensic report in a single examination session.

The Decommissioned-Account Use Case

A related scenario: a service account, shared mailbox or business-process mailbox is decommissioned as part of an IT cleanup. The OST on the workstation(s) that synced that mailbox remains. The forensic question is what was in that mailbox at the point of decommissioning.

For service accounts that received automated alerts, transaction notifications or compliance-relevant communications, the OST may be the only forensic-grade record of what the account received. The decommissioned-account OST examination follows the same workflow as the ex-employee case but with different scoping questions (focus on automated-message patterns rather than human-authored content).

The Broken-Profile Use Case

A third scenario: the Outlook profile on the workstation broke (corruption, version mismatch, replication error and the like) and Outlook can no longer connect to the Exchange account. The OST on disk is intact and current but unreadable by the user's local Outlook. The Exchange-side account is still active; the user could rebuild the profile and re-sync the cache.

For a forensic examiner, this broken-profile scenario is operationally identical to the orphan-OST examination: the OST cannot be opened by Outlook, but the content is intact and recoverable through a direct-from-disk parser. The examination proceeds the same way.

This scenario is less common in pure-litigation cases but very common in incident-response work where the question is what email content was sitting in a compromised account's cache before remediation.

Sherlock Forensics OST Viewer vs Microsoft OST Recovery Path

Microsoft no longer ships an OST-to-PST conversion utility in current Office distributions. The historical paths (deprecated Exchange-Server-side export, Outlook archive workarounds) require either an active Exchange account on the originating mailbox or third-party recovery tools.

The third-party recovery market splits into two tiers:

Tier 1: high-cost enterprise tools ($300-$1500+ per license, annual subscription, IT-procurement cycle). Examples include Kernel for OST to PST, Stellar Converter for OST, SysTools OST Recovery. These tools handle conversion at scale but carry enterprise pricing and rarely include forensic-grade chain-of-custody documentation.

Tier 2: low-cost or free utilities with limited feature coverage, weak forensic posture, no chain of custody, no examiner attestation. Suitable for personal data recovery but not for forensic submission.

Sherlock Forensics OST Viewer Forensic Edition slots into the negative space at $67 lifetime: forensic-grade output (per-message SHA-256, chain of custody, court-ready PDF, examiner attestation) at a price point under any Tier 1 tool's annual subscription, with the full feature coverage of the OST format examination workflow.

Cross-Product Workflow

Orphan-OST examination at scale often pairs with broader case work:

  • OST Viewer + PST Viewer Forensic Edition (same SKU): the buyer of either page receives the same binary that handles PST + OST + MSG + EML. The cross-product framing is unified internally; the marketing surface adapts to the buyer's entry point.
  • OST Viewer + Universal Events Viewer Forensic Edition: correlate email evidence from orphan OST with Windows Event Log timeline from the same workstation. EVTX timestamps align with OST message timestamps to reconstruct user-activity sequences during the relevant case window.
  • OST Viewer + Browser Viewer Forensic Edition: ex-employee workstation cases often pair email evidence with browser-history evidence to reconstruct the full user-activity record. Browser Viewer Forensic Edition handles browser artifacts; OST Viewer handles the email-cache artifacts.
  • OST Viewer + OCR Reader Forensic Edition: for cases where the orphan OST contains scanned-document attachments, OCR Reader handles the document-text extraction layer alongside OST Viewer's email-examination layer.
  • OST Viewer + USB Write Blocker Forensic Edition: for OST extraction from a forensically-preserved workstation image, USB Write Blocker handles the acquisition-side write-protection while OST Viewer handles the examination-side parsing.

For practices building the Sherlock Forensics email-forensics toolkit, OST Viewer Forensic Edition at $67 + UEV Forensic Edition at $97 + Browser Viewer Forensic Edition at $29 covers the orphan-employee-workstation triple-evidence-axis at under $200 lifetime combined.

Related Forensic Examination Workflows

See Also