If you have an Outlook-related file in front of you and you are not sure what it is or how to open it, this page answers both questions. The four formats look similar from the outside but serve very different purposes inside.
Quick Reference
| Format | Extension | What it contains | Created by | Opens with |
|---|---|---|---|---|
| PST | .pst | Complete Outlook mailbox (mail, calendar, contacts, tasks, journal) | Outlook (export or local-account profile) | Outlook, standalone PST viewer |
| OST | .ost | Cached copy of an Exchange or Microsoft 365 mailbox for offline use | Outlook (when configured with Exchange/M365 account) | Outlook (when account is active), standalone OST viewer |
| MSG | .msg | A single Outlook email or item | Outlook (drag-out or save-as) | Outlook, standalone MSG viewer, some email clients |
| EML | .eml | A single email in RFC 5322 internet standard format | Thunderbird, Apple Mail, most email clients | Any modern email client, plain text viewer |
PST : Personal Storage Table
A .pst file is a complete Outlook mailbox in a single file. It contains messages, calendar entries, contacts, tasks, journal items and notes, everything that would be in a personal Outlook installation.
When you encounter a PST:
- An employee exported their mailbox before leaving the company
- An archive of an old mailbox kept after migration to a new system
- A backup of a personal Outlook installation
- A produced artifact in litigation or e-discovery
- A consolidation of multiple mailboxes into a single archive
Two format variants:
- ANSI PST, used by Outlook 2002 and earlier (and Outlook 2003 with Personal Folders compatibility). 2 GB maximum file size. Single-byte character encoding.
- Unicode PST, used by Outlook 2003 and later (including Microsoft 365). 50 GB maximum file size. Full Unicode character set.
The two variants are not interoperable at the byte level, a tool that handles one may fail on the other. Modern Outlook converts ANSI PSTs to Unicode on import, but the conversion is one-way; the original ANSI structure is lost.
How to open a PST without Outlook: Use a standalone PST viewer. Sherlock Forensics PST Viewer Forensic Edition handles both ANSI and Unicode PSTs without an Outlook installation.
OST : Offline Storage Table
A .ost file is a cached copy of an Exchange Server or Microsoft 365 mailbox. Outlook creates and maintains it automatically when you connect to an Exchange or M365 account, so you can read mail while disconnected from the network.
Critical difference from PST: an OST is tied to a specific Outlook profile and a specific Exchange/M365 account. Disconnecting the OST from its parent profile typically makes it unreadable through Outlook. The data is still inside the file, but Outlook will not open it without the matching profile and account credentials.
When you encounter an OST:
- An employee's workstation is being decommissioned and the IT team wants to recover mailbox data without the active account
- An Exchange Server crashed and the local OST is the only surviving copy of recent mail
- A forensic acquisition of a workstation includes the user's OST file
- An archive folder on a former employee's laptop contains historical OST files
The "orphan OST" problem: When the parent Outlook profile or Exchange account no longer exists, the OST becomes unreadable through Outlook. The standard Microsoft solution is to discard the OST because the authoritative copy lived on the Exchange server. In real-world forensic and recovery scenarios, the Exchange server is often gone too and the orphan OST is the only copy of the data.
How to open an orphan OST: Use a standalone OST viewer that does not require the parent Outlook profile. Sherlock Forensics PST Viewer Forensic Edition reads OST files in addition to PST. The contents extract to EML or other portable formats.
MSG : Outlook Message
A .msg file is a single Outlook item, an email, a calendar entry, a contact, a task or a journal record, saved as an individual file. You produce .msg files by dragging a message out of Outlook onto your desktop or via File > Save As within an open message.
When you encounter an MSG:
- An email forwarded as an attachment from one Outlook user to another, preserving original headers
- An evidence-grade single-message production in litigation or HR investigation
- An archive of important messages saved individually outside the main mailbox
- A Bates-stamped exhibit in a production set
MSG vs EML: Both are single-message formats but MSG is Outlook's proprietary structure and EML is the internet standard (RFC 5322). MSG preserves Outlook-specific properties (categories, flags, conversation index) that EML does not. EML is portable to non-Microsoft mail clients; MSG opens cleanly only in Outlook or a dedicated MSG viewer.
How to open an MSG without Outlook: Use a standalone MSG viewer. Sherlock Forensics MSG Viewer Forensic Edition is built specifically for this format. Sherlock Forensics PST Viewer Forensic Edition also reads MSG files as one of its supported input formats.
EML : RFC 5322 Internet Mail Format
A .eml file is a single email in the standard internet mail format. Headers and body are in plain text per RFC 5322. Attachments are MIME-encoded.
When you encounter an EML:
- Email exported from Thunderbird, Apple Mail or another standards-compliant mail client
- Email exported from a webmail interface (Gmail, Yahoo, Outlook.com offer EML export)
- E-discovery production from any of the major review platforms (Relativity, Logikcull, Concordance, Reveal, Everlaw all ingest and export EML)
- Output from a standalone PST or NSF viewer's export function
EML is the e-discovery standard. When emails are produced to opposing counsel or ingested into a review platform, EML is the default expected format. Folder hierarchy is typically preserved by writing one .eml per email into a directory tree that mirrors the original mailbox folders.
How to open an EML: Any modern email client opens EML directly. Double-click in Windows or macOS to open in the default mail handler. Notepad or any plain-text editor reads the raw content (though MIME-encoded attachments will not render). Web browsers open EML files inline in most cases.
Choosing the Right Tool by File Format
| File extension | Recommended tool | Price | Why |
|---|---|---|---|
| .pst (ANSI or Unicode) | Sherlock Forensics PST Viewer Forensic Edition | $67 | Handles both format variants, forensic-grade output, $67 lifetime |
| .ost (orphan, no parent profile) | Sherlock Forensics PST Viewer Forensic Edition | $67 | Reads OST without requiring the Exchange profile |
| .msg (single message) | Sherlock Forensics MSG Viewer Forensic Edition | $67 | Built for MSG specifically; also opens in PST Viewer if you have it |
| .eml (single message) | Any email client | Free | EML is portable, no specialized tool needed for casual viewing |
| Bulk .eml directory (e-discovery production) | Sherlock Forensics PST Viewer Forensic Edition | $67 | Reads the directory tree with preserved folder hierarchy |
For users handling multiple format types regularly, the PST Viewer at $67 covers PST, OST, MSG and EML in a single tool, plus the forensic features for evidentiary work.
Cross-Format Conversion
Sometimes the question is not "how do I read this format" but "how do I convert it to a format I prefer."
| From | To | Path |
|---|---|---|
| PST | EML (directory tree) | Sherlock PST Viewer Forensic Edition export |
| PST | MBOX | Sherlock PST Viewer Forensic Edition export |
| PST | PDF (forensic report) | Sherlock PST Viewer Forensic Edition export |
| OST | PST | Sherlock PST Viewer Forensic Edition → EML → Outlook import → new PST |
| OST | EML (directory tree) | Sherlock PST Viewer Forensic Edition export |
| MSG | EML | Sherlock MSG Viewer or PST Viewer export |
| MSG | Sherlock MSG Viewer or PST Viewer export | |
| EML | Any standard mail client print-to-PDF or Sherlock export | |
| EML | MBOX | Any modern mail client (Thunderbird import) |
| EML | PST | Outlook File > Open & Export > Import EML |
The EML-as-intermediate-format pattern recurs because EML is the most portable. From EML, you can reach any other email format with standard tooling.
Forensic and Evidentiary Use
For non-evidentiary use (personal archive, IT migration, format conversion), any reasonable tool handles the job. For evidentiary use (litigation, investigation, regulatory inquiry), the requirements shift:
- Read-only operation. The tool must not modify the source file. Outlook modifies PSTs on first open (indexing, view rebuild). A forensic-grade tool does not.
- SHA-256 chain. Hash the source file at intake and every artifact at extraction. Documents the chain from source to production.
- Court-ready report. Branded forensic PDF with cover page, source metadata, hash verification table, examiner attestation, chain-of-custody footer.
- Defensible export format. EML directory tree with preserved folder hierarchy is the e-discovery standard.
Sherlock Forensics PST Viewer Forensic Edition is built for this workflow at the $67 price point. The free PST viewers handle non-evidentiary use cases.
See Also
- Sherlock Forensics PST Viewer Forensic Edition, product page
- How to Open PST Files Without Outlook, practical workflow guide
- PST File Forensic Examination: The Practitioner's Guide, deeper forensic workflow
- Sherlock Forensics MSG Viewer Forensic Edition, for MSG-specific examination