100% read-only by design
The source file on disk is never touched, never modified, never "helpfully updated." Court-ready posture from the first click.
Pre-launch waitlist v1.0.0-preview
Forensic-Grade Lotus Notes Examination. No Notes Client Required.
The migration tools give you a PST and call it done. The free NSF viewers quietly require Lotus Notes to be installed. Neither helps when you need to defend the chain of custody in a deposition.
Sherlock Forensics NSF Viewer Forensic Edition is a purpose-built Rust parser, no Notes runtime and no legacy C wrappers. One signed 6 MB executable. Reads .nsf, .ntf, .nsg and mail.box files off disk from HCL Notes 14 archives back through legacy Domino databases. Built for the e-discovery analyst, the IR investigator, the corporate legal-hold examiner and the forensic consultant whose work has to survive cross-examination.
- No Lotus Notes installation required
- Reads .nsf, .ntf, .nsg and mail.box formats
- Cryptographic NoteID identity verification per document
- SHA-256 per artifact
- Centisecond chain of custody logging
- One-time purchase, lifetime license
The honest answer
Open NSF Files Without Lotus Notes. Actually.
Every other NSF viewer on the market markets the same promise: open .nsf files without the Notes client. Then you download one and hit the system requirements page: Lotus Notes 8.5 must be installed. IBM Notes 9 required. HCL Notes client recommended.
That promise is broken industry-wide.
Sherlock Forensics NSF Viewer Forensic Edition is built on a purpose-built Rust parser. There is no OLE wrapper around the Notes client. There is no MAPI dependency. There is no required HCL or IBM software on the workstation. One signed 6 MB executable that reads .nsf, .ntf, .nsg and mail.box files straight off disk. Drop in a database from a 2008 Domino server or a 2026 HCL Notes 14 archive and read it. That is the entire promise. We deliver it.
Forensically sound by design
Built for the Buyer Whose Work Survives Cross-Examination
Cryptographic identity verification per document
Every note is verified against its NoteID. If the parser cannot prove a record is the right one, it flags the discrepancy instead of guessing. No fabricated evidence, ever.
Full chain-of-custody metadata on every artifact
UNID, created timestamp, modified timestamp and note class, captured down to the centisecond.
SHA-256 per artifact
Each email, attachment, contact record and calendar item is hashed at extraction. The hash is stored alongside the artifact in the report. Re-extract the same database a year later and the hashes match. Proof the source was not altered between examination and production.
Visibility at the field level
See Everything Inside
- Enumerate every document in the database. Tens of thousands of records surfaced in seconds.
- Real field names rendered, not cryptic codes. FirstName, InternetAddress, OfficeStreetAddress and the full schema as designed.
- Smart-typed values. Dates render as dates, numbers as numbers, text as text. Automatic.
- Rich-text bodies rendered to readable text. Read the actual message, not a blob.
- Attachments extracted byte-perfect with one click. Images, documents and the rest of the artifact set.
Performance proof
Built for Monster Databases
Handles 140 MB+ databases with 40,000+ documents without breaking a sweat. Virtualized browsing scrolls 42,000 records smoothly. Full keyboard navigation: arrows, Page Up, Page Down, Home, End. Live filtering: type and the list narrows instantly.
Pricing rationale
Why You Pay More for Sherlock Forensics NSF Viewer Forensic Edition
A reasonable question. Aryson NSF Viewer is $49. SysTools is $69. MailsDaddy starts at $99. Stellar Converter for NSF runs $149 to $399 across its tiers. Kernel for NSF to PST sits at $249.
Sherlock Forensics NSF Viewer Forensic Edition is $297. Higher than every commodity tool, higher than every migration tool. Comparable to Notes the Ripper ($349.95) and well below MailXaminer's hidden enterprise pricing.
Here is what you get for the difference that none of those products ship:
Chain of custody logging. Every artifact extracted from an .nsf file is tracked with timestamp, source file hash, examiner identity (configurable) and export destination. The log is appended to the PDF report and exportable as a separate signed JSON document that survives evidentiary review.
SHA-256 hashing on every artifact. Each email, attachment, contact record and calendar item is hashed at extraction. The hash is stored alongside the artifact in the report. Re-extract the same .nsf file a year later and the hashes match.
Court-ready PDF reports. Branded forensic PDF with cover page, source file metadata, artifact inventory, SHA-256 verification table, examiner attestation block and chain-of-custody footer on every page. The format is what e-discovery review platforms expect to ingest and what courts expect to see attached to a declaration.
Encryption metadata surfacing. Encrypted NSF documents are common in regulated industries. Sherlock detects sealed items, counts them and surfaces seal-structure metadata where the format documents it. Knowing what you cannot read is sometimes more important than reading it.
Forensic-resilience by design. Malformed templates, partially-uninitialized records, fresh-template garbage, deliberately-corrupted superblocks. The parser handles them silently with bounds checking rather than crashing. The tool you use on a hostile-source NSF should not crash on the artifact that might matter.
Buyer fit
Built for the Premium Forensic Buyer
E-discovery and corporate legal teams
Lotus Notes presents unique challenges in e-discovery because most review platforms ingest poorly from NSF directly. Sherlock exports to EML (one file per email, with preserved mailbox folder hierarchy) for clean Relativity, Concordance, Logikcull, Reveal and Everlaw ingestion. The forensic PDF doubles as a privilege log when filtered by date or keyword.
Incident response and forensic examiners
Logical acquisitions of corporate Notes archives, family-law NSF productions, employment investigations where the subject's mail history lives in a 2009 Notes file. Court-ready reports, hash verification, chain of custody. Documentation that survives cross-examination.
Regulated-industry legal-hold administrators
Banks, insurers, government and healthcare systems still running Notes for compliance reasons. Decade-spanning NSF archives subject to legal hold. Sherlock examines the data without spoliation risk, produces tamper-evident reports and exports for downstream review.
How it compares
Sherlock NSF Viewer vs the Rest of the Market
| Feature | Sherlock NSF Forensic | Notes the Ripper | Kernel | Stellar | SysTools |
|---|---|---|---|---|---|
| Price | $297 lifetime | $349.95 / 3-year | $249-$499 | $149-$399 | $69 |
| License model | Lifetime | 3-year | Per-tier | Per-tier | One-time |
| Lotus Notes installation required | No | No | Unclear | Unclear | Yes |
| Reads HCL Notes 14 | Yes | Limited | Yes | Yes | No |
| NSF + NTF + NSG + mail.box | Yes | .nsf only | .nsf only | .nsf only | .nsf only |
| NoteID cryptographic identity verification | Yes | No | No | No | No |
| SHA-256 per artifact | Yes | No | No | No | No |
| Centisecond chain of custody | Yes | No | No | No | No |
| Court-ready forensic PDF | Yes | ASCII / RTF / HTML | No | No | No |
| Structured JSONL forensic export | Yes | No | No | No | No |
| NSF to EML (preserved folder hierarchy) | Yes | Limited | No | Yes | No |
| Encryption metadata surfacing | Yes | No | No | Limited | No |
| Bounds-checked malformed-data handling | Yes | Standard | Unknown | Unknown | Unknown |
| Performance at 140 MB / 40,000+ documents | Yes | Not documented | Not documented | Not documented | Not documented |
| EV code-signed binary | Yes (SSL.com / Sherlock Forensics Ltd) | Yes | Yes | Yes | Yes |
| Cross-platform at launch | Windows (Linux on roadmap) | Windows only | Windows | Windows | Windows |
The two products at the forensic price tier (Sherlock and Notes the Ripper) are the only ones with genuinely standalone parsers. See the full Sherlock vs Notes the Ripper comparison.
v1.0 capability scope
What Ships in v1
- Purpose-built Rust parser, one signed 6 MB executable, no Notes runtime
- Reads .nsf, .ntf, .nsg and mail.box formats
- HCL Notes 14 and back through legacy Domino databases
- Mail, contacts, calendar, journals and to-do extraction with preserved folder hierarchy
- Cryptographic NoteID identity verification per document
- Centisecond chain-of-custody metadata
- 100% read-only by design
- 140 MB+ databases, 40,000+ documents tested
- Live filtering, full keyboard navigation, virtualized browsing
- Forensic JSONL export (every field decoded, body extracted, attachment manifest)
- Court-ready forensic PDF reports with SHA-256 verification table
- Encryption metadata surfacing (ITEM_SEAL, TYPE_SEAL, TYPE_SEAL2, TYPE_SEALDATA)
- EV code-signed (SSL.com, "Sherlock Forensics Ltd" publisher)
- Windows 10 and Windows 11 at launch
- Linux build on the roadmap
Editions
Forensic Edition vs Free Viewer
Free Edition
$0 USD
Genuinely free. No item caps, no time limit, no nag screens.
- Open .nsf, .ntf, .nsg and mail.box files
- Browse and search the full document set
- Read fields with real names, not cryptic codes
- View rich-text message bodies as readable text
- View attachments inline
- Full visibility, no paywall on looking
Forensic Edition
$297 USD lifetime
In pre-launch. Everything in Free, plus the forensic chain.
- Bulk export with filtering (export the precise slice, not a bloated dump)
- Attachment extraction at scale
- Signed court-ready forensic PDF reports
- SHA-256 per-artifact hashing on export
- Centisecond chain-of-custody output (JSONL sidecar plus PDF footer)
- Structured JSONL export for review platforms and pipelines
- Command-line automation for bulk processing
- Priority email support
Forensic Edition is also unlocked instantly with an active Sherlock Forensics Suite license. One license, every tool.
Pre-launch signup
Join the NSF Viewer Waitlist
We will email when Sherlock Forensics NSF Viewer Forensic Edition is available. No spam. Early subscribers get launch-week pricing.
FAQ
Frequently Asked Questions
Why does Sherlock cost more than Kernel or Stellar?
Because we built features they did not. Kernel and Stellar are migration tools, their job ends when they hand you a PST. Sherlock Forensics NSF Viewer Forensic Edition is built for the examiner whose job starts with the report. SHA-256 hashing, chain of custody, court-ready PDF and bounds-checked forensic parsing are table stakes at the forensic tier and absent at the migration tier. The price reflects the scope.
Do I need Lotus Notes installed?
No. Unlike the rest of the NSF viewer market, Sherlock Forensics NSF Viewer Forensic Edition is built on a purpose-built Rust parser that runs standalone. No Lotus Notes, no HCL Notes, no IBM Notes, no Domino server, no MAPI runtime.
Does this work with HCL Notes and IBM Notes, or just Lotus Notes?
All three. The .nsf file format is the same across IBM Lotus Notes (the original branding), IBM Notes (the rebrand) and HCL Notes (after the 2018 sale to HCL Technologies). HCL Notes 14 archives back through legacy Domino databases are supported.
Can I get an .nsf into Outlook or Office 365 without a PST writer?
Yes. Sherlock exports each message as an EML file with the original folder hierarchy preserved as a directory tree. Outlook 2016 and later imports EML natively via File > Open & Export > Import. Office 365 imports the resulting PST via Microsoft's free Network Upload service. The full path is two clicks longer than a direct PST writer would be, and Microsoft's native tools are free.
Is the forensic PDF report admissible in court?
The report includes SHA-256 hashing of every artifact, chain of custody logging with centisecond timestamps, source NSF metadata, examiner attestation and a tamper-evident format. These are the standard elements courts and e-discovery review platforms expect to see. Final admissibility depends on jurisdiction and case-specific rules, but Sherlock supplies the forensic evidence chain a court requires.
How does this compare to Cellebrite or Magnet Axiom?
Cellebrite UFED and Magnet Axiom are physical device extraction platforms costing $5,000 to $20,000+ annually. They serve law enforcement and high-end DFIR teams doing full mobile and disk imaging. Sherlock Forensics NSF Viewer Forensic Edition is a focused tool for one specific job: extracting and reporting on NSF email archives. If your case is a corporate Notes archive or a logically-acquired backup, you do not need Cellebrite for it.
What about encrypted NSF documents?
Sherlock detects sealed items via the ITEM_SEAL flag and surfaces TYPE_SEAL, TYPE_SEAL2 and TYPE_SEALDATA structure metadata where the format documents it. The number of sealed items in a document is reported. The wrapped content encryption key envelope is not publicly documented and cannot be decrypted without organizational key material.
One-time purchase or subscription?
One-time. $297 buys a lifetime license. Future major version upgrades within the same product line are included for the first two years from purchase. Forensic Edition is also unlocked instantly with an active Sherlock Forensics Suite license: one license, every tool.
See also
More NSF Forensics Reading
- How to Open NSF Files Without Lotus Notes (The Honest Guide), the technical guide to standalone NSF tools
- Sherlock NSF Viewer vs Notes the Ripper, peer-pricing forensic comparison