The Problem We Kept Running Into
For 20 years Sherlock Forensics has processed email evidence in litigation support, internal investigations and regulatory compliance matters. PST files show up in nearly every case that involves a current or former Microsoft Outlook user. They are the single most common email artifact in civil litigation.
For most of those 20 years we paid for tools that were not designed for forensic work. SysTools PST Viewer Pro costs $299 USD. It is a capable migration and conversion tool. But it was built by a software company for IT administrators, not by forensic examiners for courtroom use. It does not hash individual messages. It does not generate chain of custody documentation. It does not produce reports that a forensic examiner can sign and submit as evidence.
FTK handles PST files as part of a comprehensive forensic suite. But FTK starts at $3,000 USD with annual licensing. Using a full forensic platform to examine a single PST file is like renting a commercial kitchen to toast bread. It works, but the cost and complexity are disproportionate to the task.
We needed something in the middle. A tool that understood forensic requirements, produced court-ready output and cost less than a dinner for two.
Built by Examiners, Not a Software Company
This is the distinction that matters. Every PST viewer on the market was built by a software company that identified email files as a market opportunity. They approach the problem from a software engineering perspective: how do we parse this file format and present the data?
We approached it from the witness stand. What does a forensic examiner need to testify about this evidence? What will opposing counsel challenge? What documentation does the court require?
Those questions produce a fundamentally different tool. The Sherlock PST Viewer was designed around the examination workflow we use every week. Open the file in read-only mode. Search for relevant messages. Mark the ones that matter. Generate a report with cryptographic verification of each message. Submit that report as evidence.
The people who built this tool are the same people who testify about its output. That alignment between builder and user does not exist anywhere else in this market below the $3,000 price point.
SHA256 Per-Message Hashing
This is the feature that prompted us to build the tool in the first place. When you present email evidence in court, opposing counsel will ask how you can verify that the message has not been altered. With most PST viewers, the honest answer is: you cannot. You extracted the message. You have the file. But you have no cryptographic proof that the extracted message matches what was in the original PST file.
Sherlock PST Viewer Pro computes a SHA256 hash for every message at the time of examination. That hash is recorded in the examination log and included in the PDF report. If anyone challenges the integrity of a specific message, the hash can be independently verified against the source PST file.
This is not a novel concept. Forensic imaging tools have done this for disk images for decades. But no PST viewer under $3,000 applied this principle to individual email messages until now.
The Mark and PDF Report Feature
In a real investigation you rarely need every message in a PST file. A 10GB PST might contain 50,000 messages. Your investigation concerns 47 of them. Exporting the entire mailbox and then manually locating the relevant messages is tedious and wasteful.
The Mark and PDF Report feature lets you flag specific messages during your review. When you have identified all relevant messages, you generate a single PDF report containing only the marked items. Each message in the report includes:
- Full message headers (From, To, CC, BCC, Date, Subject, Message-ID)
- Message body rendered in the report
- Attachment listing with file names and sizes
- SHA256 hash of the message
- Examiner notes field for each message
- Chain of custody header with examination metadata
The output is a single PDF that you can attach to an affidavit, submit as an exhibit or deliver to counsel. No additional formatting required. No post-processing. The report is court-ready as generated.
Court-Ready Output
We use the phrase "court-ready" deliberately. It means the output meets the documentation standards that courts expect for digital evidence. Specifically:
- Read-only access
- The tool cannot modify the source PST or OST file. This is verifiable. The original file's hash remains unchanged after examination.
- Chain of custody documentation
- Every report includes examiner identification, examination date and time, source file hash, tool version and examination parameters.
- Per-message integrity verification
- SHA256 hash for each message allows independent verification that the reported content matches the source.
- Audit trail
- The tool logs every action taken during the examination. What was searched, what was viewed, what was marked and what was exported.
These are not optional features. They are the baseline requirements for presenting digital evidence in any jurisdiction that follows Daubert or similar admissibility standards. The fact that most PST viewers lack these features tells you they were not designed for forensic use.
OST Support
PST files get most of the attention, but OST files are equally common in investigations. An OST file is the local cache that Outlook maintains for Exchange mailboxes. When an employee leaves an organization or loses Exchange connectivity, the OST file often becomes the only accessible copy of their email.
Sherlock PST Viewer opens both PST and OST files natively. No conversion step required. The same forensic features apply to both formats: SHA256 hashing, chain of custody reporting and read-only access. The OST viewer functionality works identically to PST viewing.
The $67 Pricing Story
People ask why the tool costs $67. The real question is why competing tools cost $299 or more.
Sherlock Forensics is a forensic consultancy, not a software company. We do not have a sales team. We do not attend trade shows. We do not run Google Ads campaigns with per-click costs that get baked into the product price. We do not have venture capital investors demanding growth metrics.
We have forensic examiners who built a tool they needed and decided to make it available to other examiners. The $67 price covers our development and maintenance costs. It does not need to cover a marketing department or investor returns.
The license is permanent. One payment. No subscription. No annual renewal. No "maintenance fees" that quietly double the cost over three years. You pay $67 once and you own the Pro license.
The Free Edition
Not everyone needs forensic features. IT administrators who need to view a PST file without Outlook. Paralegals doing initial document review. Users recovering their own archived email. These use cases do not require SHA256 hashing or chain of custody reports.
The Sherlock PST Viewer Free Edition opens PST and OST files with full-text search and individual email export. There is no trial period. There are no feature nag screens. There is no data collection or telemetry. The Free edition is genuinely free with no strings attached.
If your work progresses to the point where you need forensic-grade output, the Pro upgrade is $67. That transition is seamless because both editions use the same codebase.
Who This Tool Is For
We built Sherlock PST Viewer for a specific audience:
- Forensic examiners who need court-admissible PST analysis without paying $3,000+ for a full forensic suite
- Litigation support professionals who prepare email evidence for attorneys
- Law firms handling eDiscovery and document review in-house
- Corporate investigators conducting internal investigations involving employee email
- HR departments that need to review departing employee mailboxes
- IT administrators who need to access PST files without Outlook (Free edition)
If you fall into one of these categories, download the Free edition and evaluate it against whatever tool you currently use. If you need the forensic features, the Pro edition is $67.
What We Are Not
We are not trying to replace FTK or EnCase. Those are comprehensive forensic platforms that do far more than PST analysis. If you need full disk forensics, memory analysis, mobile forensics and PST viewing in a single platform, those tools serve that purpose.
We are also not a conversion tool. If you need to migrate 10,000 PST files to MBOX format for a platform migration, SysTools is better suited for that task. Sherlock PST Viewer is an examination and reporting tool, not a bulk conversion engine.
We solve one problem well: forensic examination and court-ready reporting of PST and OST email files at a price that does not require budget approval from a committee.