Forensic-Grade Lotus Notes Examination. No Notes Client Required.

Every other NSF viewer on the market markets the same promise: open .nsf files without the Notes client. Then you download one and hit the system requirements page: Lotus Notes 8.5 must be installed. IBM Notes 9 required. HCL Notes client recommended.

That promise is broken industry-wide.

Sherlock Forensics NSF Viewer Forensic Edition is built on a purpose-built Rust parser. There is no OLE wrapper around the Notes client. There is no MAPI dependency. There is no required HCL or IBM software on the workstation. A single signed executable that reads .nsf, .ntf, .nsg and mail.box files straight off disk. No installer, no dependencies, no runtime. It runs from a USB stick on an air-gapped examination workstation. Drop in a database from a 2008 Domino server or a 2026 HCL Notes 14 archive and read it. That is the entire promise. We deliver it.

Sherlock is a from-scratch NSF parser: not a wrapper around the Notes client, not a port of an existing NSF parser codebase. The Rust NSF parser reads the on-disk b-tree format directly so the workflow to read NSF documents requires no Notes runtime, no DLL loading, no licensing dependency on HCL or IBM. Examiners can read NSF archives from disk, from network shares or from forensic disk images interchangeably. As a Lotus Notes alternative for examiners and administrators with NSF archives but no active Lotus Notes seats, this is the practical answer. The same Lotus Notes alternative argument carries over to the M365 migration buyer, the e-discovery review buyer and the forensic examiner: an NSF parser that lets you read NSF data without paying for a Lotus Notes alternative seat or a Lotus Notes alternative migration suite is the focused tool for the job.

• Enumerate every document in the database. Tens of thousands of records surfaced in seconds.
• Real field names rendered, not cryptic codes. FirstName, InternetAddress, OfficeStreetAddress and the full schema as designed.
• Smart-typed values. Dates render as dates, numbers as numbers, text as text. Automatic.
• Rich-text bodies rendered to readable text. Read the actual message, not a blob.
• Attachments extracted byte-perfect with one click. Images, documents and the rest of the artifact set.

Multi-gigabyte Domino files open by mapping them rather than copying into memory, so database size no longer limits what can be examined. Browsing was tested smooth at 140 MB with 40,000 documents, and virtualized browsing scrolls 42,000 records without stutter. Full keyboard navigation: arrows, Page Up, Page Down, Home, End. Live filtering: type and the list narrows instantly.

A reasonable question. Aryson NSF Viewer is $49. SysTools is $69. MailsDaddy starts at $99. Stellar Converter for NSF runs $149 to $399 across its tiers. Kernel for NSF to PST sits at $249.

Sherlock Forensics NSF Viewer Forensic Edition is $297. Higher than every commodity tool, higher than every migration tool. Comparable to Notes the Ripper ($349.95) and well below MailXaminer's hidden enterprise pricing.

Here is what you get for the difference that none of those products ship:

SHA-256 per artifact and Chain-of-Custody manifest (v1.2.0). v1.2.0 ships SHA-256-per-artifact verifiable export with source-bytes hash anchor. Every exported note and attachment carries a SHA-256 in the manifest. The acquisition is hash-anchored from source-bytes through per-artifact hashes for court-defensible chain across the full export.

Standalone Rust parser, no Notes runtime. The free NSF viewers quietly require Lotus Notes or HCL Notes to be installed. Migration tools the same. Sherlock reads .nsf, .ntf, .nsg and mail.box files off disk with no runtime dependency on IBM, HCL or Domino. Drop a database from a 2008 Domino server or a 2026 HCL Notes 14 archive in front of it and read the records.

NoteID/RRV identity resolution per document. Every note's NoteID/RRV is resolved through the BDB structure and validated against the corpus. If the parser cannot resolve a record to a coherent identity, it flags the discrepancy instead of guessing. No silent substitutions in the extracted output.

Byte-perfect attachment extraction. Attachments are extracted from the NSF without re-encoding, normalization or "helpful" cleanup. What gets written to disk is bit-for-bit what was stored in the source. The MIME types and original filenames are preserved.

Forensic-resilience by design. Malformed templates, partially-uninitialized records, fresh-template garbage, deliberately-corrupted superblocks. The parser handles them with bounds checking rather than crashing. The tool you reach for on a hostile-source NSF should not crash on the artifact that matters.

Encryption metadata surfacing. Encrypted NSF documents are common in regulated industries. Sherlock detects sealed items, counts them and surfaces seal-structure metadata where the format documents it. Knowing what you cannot read is sometimes more important than reading it.

Structured forensic JSONL export and NSF to PST. Every record is exported as a structured JSONL row with subject, from, to, date, body, attachment manifest and NoteID. Relativity, Concordance, Logikcull, Reveal and Everlaw ingest the format directly. The NSF to PST path drops the same data into an Outlook-importable PST for review workflows that prefer native MAPI.

The summary on the value proposition: Sherlock at $297 lifetime delivers a standalone NSF parser with NoteID/RRV identity resolution, byte-perfect attachment extraction, JSONL forensic export and NSF to PST conversion. The commodity tier at $49 to $99 ships none of that capability set. Pay the difference if your workflow requires reading NSF without Lotus Notes seats and producing structured forensic output for downstream review. Pick the commodity tier if your need is one-off NSF browsing on a workstation that already has the Notes client installed.

NSF e-discovery is the workflow of producing or receiving Lotus Notes archives under litigation hold. NSF litigation work covers civil cases involving employment disputes, IP theft investigations, regulatory inquiries and corporate internal investigations where the subject's mail history sits in a 2009 NSF archive nobody has touched in a decade. Sherlock's role in NSF e-discovery: producing-party export of structured JSONL forensic records for review-platform ingest and NSF to PST conversion for review workflows that prefer native Outlook import; receiving-party read-only verification of incoming productions before review begins.

Deleted-note recovery, honestly scoped. Sherlock works two layers. In-archive: it surfaces deleted notes still present in the b-tree, Recycled-folder content and items marked for deletion but not yet purged, flagged as deleted. Carved: version 1.2.78 carves note records that enumeration never reached, with checkpointing so a cancelled scan resumes where it stopped. Carved records are labelled candidates throughout. They are searchable, YARA-scannable and exportable, always as candidates, never presented as identified notes. It also builds a chronology of deleted notes and a salvage diagnosis for a database that will not open. What it does not reach, it says: recovery below the archive at the physical disk-image layer is a separate discipline and out of scope for this tool.

• Chronology of deleted notes. A time-ordered view of notes flagged deleted, spanning both in-archive deleted items and carved candidates. Candidates are labelled as candidates in the chronology and are never merged into the confirmed record.
• Salvage diagnosis. When a database will not open, Sherlock reports what structure it could read and what it could not, and why, rather than failing silently. The diagnosis is a coverage statement, not a guarantee of recovery.

For the parallel deleted-recovery discipline in the PST world see our deleted email recovery from PST guide. For the broader mid-market vs enterprise positioning context see our Cellebrite vs Magnet AXIOM 2026 comparison.

• Purpose-built Rust parser, a single signed executable, no installer or Notes runtime
• Reads .nsf, .ntf, .nsg and mail.box formats
• Reads Lotus Notes 4.x (ODS 20) through current HCL Notes 14 databases, with fields, field names, message bodies including rich text, recipient lists and dates
• Mail, contacts, calendar, journals and to-do extraction, with the folder tree reconstructed including hidden folders (folder membership, which document sits in which folder, is not built)
• NoteID/RRV identity resolution per document
• Smart-typed field rendering (dates as dates, numbers as numbers, text as text)
• Rich-text body rendering to readable text, not a raw blob
• Byte-perfect attachment extraction
• SHA-256 per artifact in exported manifest (v1.2.0)
• Chain-of-Custody manifest with source-bytes SHA-256 anchor (v1.2.0)
• Hash-anchored acquisition from source-bytes through per-artifact hashes for court-defensible chain (v1.2.0)
• 100% read-only by design
• Opens multi-gigabyte Domino files by mapping; browsing tested smooth at 140 MB and 40,000 documents
• Live filtering, full keyboard navigation, virtualized browsing
• Structured forensic JSONL export (every field decoded, body extracted, attachment manifest)
• NSF to PST conversion for Outlook import
• Encryption metadata surfacing (ITEM_SEAL, TYPE_SEAL, TYPE_SEAL2, TYPE_SEALDATA)
• EV code-signed (SSL.com, "Sherlock Forensics Ltd" publisher)
• Windows 10 and Windows 11 at launch
• Linux build on the roadmap

Lotus Notes 4.x

Lotus Notes 4.x (ODS 20) databases now open. Earlier versions showed a Notes 4 file as design-only with 0 notes and a wrong on-disk size, because Notes 4 stores positions in bytes rather than in 256-byte pages. Sherlock Forensics NSF Viewer now reads Notes 4.x files in full: fields, field names, message bodies including rich text, recipient lists and dates. Notes 4 era archives are a case most NSF tools cannot open at all.

Field decoding

Multi-recipient fields (SendTo, CopyTo and meeting attendees), date ranges, document references and stored internet headers now decode on all databases. On older mail the sender-authentication panel reads the Received headers stored in the $AdditionalHeaders item. This release also corrects a field-decoding fault where field values stored after a message body or other separately-stored item were read from the wrong bytes, which affected about 21% of notes in ordinary modern databases. Those values are now read correctly.

Attachment recovery

Sherlock Forensics NSF Viewer recovers attached files from the objects Notes stores them in. Each recovered file is verified against the SHA-1 that Notes recorded for it before it is accepted, so a file is presented only when its bytes match what Notes stored. All 16 attachments in the test corpus recover and verify. On a real Notes 4 database, Sherlock Forensics NSF Viewer recovered and verified 3,133 attachments against the SHA-1 Notes recorded. This Notes 4 attachment recovery is working but not yet complete: about 300 attachments in that database hold no recoverable bytes, and those are reported as such rather than counted as recovered.

Large files

Multi-gigabyte Domino mail files now open. An NSF over 256 MB used to be identified but not examined; the note walk was skipped. Real Domino mail files are routinely gigabytes, so that was the common case. Sherlock Forensics NSF Viewer now reads files over 256 MB by mapping them rather than copying them into memory, so database size no longer limits what can be examined. A mapping reflects the file as it is now, so the tool states on screen that the hash taken at open time stops describing the file if anything writes to it mid-examination, and it tells you to work from write-blocked media. Smaller files keep the snapshot behavior.

Support report

A support report you can read before it sends. The SUPPORT control in the rail sends the database's structural facts (format identifiers, bucket layout, what the note walk did) with your description, and it is always available, including when nothing will open. The modal shows the exact text that will be sent, in a scrollable box, before you send. No note content, no attachment bytes, no correspondent names, no search terms; none of it is redacted because none of it is collected. The file name is off by default and opt-in, because a mail file is usually named after its custodian and you should not leak that by clicking a button you thought sent version numbers. Most tools' send-diagnostics is a black box; for forensic work a black box is disqualifying.

Diagnostic extract

A one-click diagnostic extract in the SUPPORT panel saves a content-free text file for faster support: the database's internal index and field-name tables plus a few record headers, with no message content and no database title. It is opt-in and never sent automatically, and saving one is recorded in the custody log.

Search

• Database-wide keyword search (Find in NSF) with phrase and regex modes, a keyword-list paste box and search history. Hit highlighting, sortable findings and CSV export.
• Search reaches inside archive attachments and states what it could not reach, so an item it did not search is reported as unsearched, not as a clean miss.
• Cross-NSF search runs over several databases at once.

Export and conversion

• NSF to PST, single-note EML and Outlook .msg, and bulk export of the filtered view one file per note. Message class is derived per note, so not everything is labelled mail, and recipients, original internet headers and HTML bodies carry across. A conversion-fidelity record travels with the export.
• PST export scope is an explicit choice that defaults to the whole database rather than the filtered view, and the chosen scope is written to the chain of custody log. The export recreates the Notes folder tree including hidden folders. It does not reconstruct folder membership, which document sits in which folder, and does not claim to.
• Verifiable export container. Every exported artifact carries its own SHA-256 in the manifest. Those per-file hashes are bound into a single Merkle-root value that also changes if a file is renamed, removed or reordered, which the per-file list alone does not catch. An Ed25519 seal with RFC 3161 timestamping covers both. The root is a summary of the per-file hashes, not a second mechanism. It is omitted when the container holds no files, because a root over nothing would be a constant that looks like a measurement.

Analysis

• Static structural analysis. Static structural analysis of attachments and bodies. It emits a list of findings and never a verdict. Each finding is a severity, a title and a detail. Severity runs INFO, UNEXAMINED, WARNING and CRITICAL. Even CRITICAL is a structural statement, not a malware call: a Windows-executable finding says the content runs native code on a double-click, which is a fact about the file, not an accusation. An empty finding list means nothing was flagged, never that the item is clean. UNEXAMINED is ranked above INFO on purpose, so a coverage gap outranks a routine observation: an encrypted archive, an unparseable format, bytes never extracted, anything past the 64 MB or 2,000-entry cap, each produces an explicit finding that says it was not examined. Nothing is executed and nothing is written to disk. Archives are enumerated in memory, never extracted.
• YARA scanning over attachments, note bodies and carved candidates, with the ruleset identity and version recorded alongside every hit.
• Timeline histogram from note activity dates, clickable to filter and CSV-exportable. Comm-map correspondent graph from senders and recipients, with per-contact message lists.
• Attachment inventory with images rendered in place, sender authentication from retained internet headers, and a raw item explorer for note fields.

Evidence integrity

• A chain-of-custody action log with a CSV filing copy and a custody report section.
• The PDF report records the producing binary and whether that binary still verifies. When a note declares more fields than were recovered, the report names them rather than showing fewer, and fields that are expected to be absent are no longer counted as missed.
• Marks persist per evidence item keyed by UNID, across multi-database cases.

NSF migration is the workflow of moving Lotus Notes archives off Notes onto Microsoft 365, Outlook PST or another modern mail platform. Most organizations doing NSF migration at this point have legacy Notes archives but no active Domino license, no Notes client install and no budget to revive the HCL Notes stack just to extract data for migration. The typical NSF migration vendor path is Quest On Demand Migration or Microsoft FastTrack at $5 to $50 per mailbox and a Domino licensing footprint to enable the source-side extraction. The combined NSF migration cost gets ugly quickly.

The Sherlock NSF migration path: NSF Viewer Forensic Edition exports a structured JSONL forensic record per email with full metadata (subject, from, to, date, body, attachment manifest and NoteID). JSONL ingests directly into review platforms (Relativity, Concordance, Logikcull, Reveal, Everlaw) and into custom analyst pipelines. Total NSF extraction cost: Sherlock $297 lifetime versus thousands of dollars per project with dedicated migration tools and Domino revival licensing.

Honest scope on NSF migration: Sherlock handles the EXTRACTION and JSONL forensic output side AND the direct NSF to PST conversion path. A direct NSF to PST conversion path that drops into Outlook and Microsoft 365 shipped 2026-06-07. For most legal-hold, regulatory archive and e-discovery NSF workflows, the JSONL and NSF to PST output is the load-bearing deliverable: it is what review platforms ingest and what downstream Outlook-based review workflows consume.

Related: see our how to open NSF files without a Notes client guide for the technical-buyer side of the workflow and our PST Viewer for the downstream PST review tier once the NSF migration produces the PST artifact.

• How to Open NSF Files Without Lotus Notes (The Honest Guide), the technical guide to standalone NSF tools
• Sherlock Forensics NSF Viewer vs Notes the Ripper, peer-pricing forensic comparison