Forensic-Grade Lotus Notes Examination. No Notes Client Required.

Every other NSF viewer on the market markets the same promise: open .nsf files without the Notes client. Then you download one and hit the system requirements page: Lotus Notes 8.5 must be installed. IBM Notes 9 required. HCL Notes client recommended.

That promise is broken industry-wide.

Sherlock Forensics NSF Viewer Forensic Edition is built on a purpose-built Rust parser. There is no OLE wrapper around the Notes client. There is no MAPI dependency. There is no required HCL or IBM software on the workstation. One signed 6 MB executable that reads .nsf, .ntf, .nsg and mail.box files straight off disk. Drop in a database from a 2008 Domino server or a 2026 HCL Notes 14 archive and read it. That is the entire promise. We deliver it.

Sherlock is a from-scratch NSF parser: not a wrapper around the Notes client, not a port of an existing NSF parser codebase. The Rust NSF parser reads the on-disk b-tree format directly so the workflow to read NSF documents requires no Notes runtime, no DLL loading, no licensing dependency on HCL or IBM. Examiners can read NSF archives from disk, from network shares or from forensic disk images interchangeably. As a Lotus Notes alternative for examiners and administrators with NSF archives but no active Lotus Notes seats, this is the practical answer. The same Lotus Notes alternative argument carries over to the M365 migration buyer, the e-discovery review buyer and the forensic examiner: an NSF parser that lets you read NSF data without paying for a Lotus Notes alternative seat or a Lotus Notes alternative migration suite is the focused tool for the job.

• Enumerate every document in the database. Tens of thousands of records surfaced in seconds.
• Real field names rendered, not cryptic codes. FirstName, InternetAddress, OfficeStreetAddress and the full schema as designed.
• Smart-typed values. Dates render as dates, numbers as numbers, text as text. Automatic.
• Rich-text bodies rendered to readable text. Read the actual message, not a blob.
• Attachments extracted byte-perfect with one click. Images, documents and the rest of the artifact set.

Handles 140 MB+ databases with 40,000+ documents without breaking a sweat. Virtualized browsing scrolls 42,000 records smoothly. Full keyboard navigation: arrows, Page Up, Page Down, Home, End. Live filtering: type and the list narrows instantly.

A reasonable question. Aryson NSF Viewer is $49. SysTools is $69. MailsDaddy starts at $99. Stellar Converter for NSF runs $149 to $399 across its tiers. Kernel for NSF to PST sits at $249.

Sherlock Forensics NSF Viewer Forensic Edition is $297. Higher than every commodity tool, higher than every migration tool. Comparable to Notes the Ripper ($349.95) and well below MailXaminer's hidden enterprise pricing.

Here is what you get for the difference that none of those products ship:

SHA-256 per artifact plus Chain-of-Custody manifest (v1.2.0). v1.2.0 ships SHA-256-per-artifact verifiable export with source-bytes hash anchor. Every exported note and attachment carries a SHA-256 in the manifest. The acquisition is hash-anchored from source-bytes through per-artifact hashes for court-defensible chain across the full export.

Standalone Rust parser, no Notes runtime. The free NSF viewers quietly require Lotus Notes or HCL Notes to be installed. Migration tools the same. Sherlock reads .nsf, .ntf, .nsg and mail.box files off disk with no runtime dependency on IBM, HCL or Domino. Drop a database from a 2008 Domino server or a 2026 HCL Notes 14 archive in front of it and read the records.

NoteID/RRV identity resolution per document. Every note's NoteID/RRV is resolved through the BDB structure and validated against the corpus. If the parser cannot resolve a record to a coherent identity, it flags the discrepancy instead of guessing. No silent substitutions in the extracted output.

Byte-perfect attachment extraction. Attachments are extracted from the NSF without re-encoding, normalization or "helpful" cleanup. What gets written to disk is bit-for-bit what was stored in the source. The MIME types and original filenames are preserved.

Forensic-resilience by design. Malformed templates, partially-uninitialized records, fresh-template garbage, deliberately-corrupted superblocks. The parser handles them with bounds checking rather than crashing. The tool you reach for on a hostile-source NSF should not crash on the artifact that matters.

Encryption metadata surfacing. Encrypted NSF documents are common in regulated industries. Sherlock detects sealed items, counts them and surfaces seal-structure metadata where the format documents it. Knowing what you cannot read is sometimes more important than reading it.

Structured forensic JSONL export plus NSF to PST. Every record is exported as a structured JSONL row with subject, from, to, date, body, attachment manifest and NoteID. Relativity, Concordance, Logikcull, Reveal and Everlaw ingest the format directly. The NSF to PST path drops the same data into an Outlook-importable PST for review workflows that prefer native MAPI.

The summary on the value proposition: Sherlock at $297 lifetime delivers a standalone NSF parser with NoteID/RRV identity resolution, byte-perfect attachment extraction, JSONL forensic export and NSF to PST conversion. The commodity tier at $49 to $99 ships none of that capability set. Pay the difference if your workflow requires reading NSF without Lotus Notes seats and producing structured forensic output for downstream review. Pick the commodity tier if your need is one-off NSF browsing on a workstation that already has the Notes client installed.

NSF e-discovery is the workflow of producing or receiving Lotus Notes archives under litigation hold. NSF litigation work covers civil cases involving employment disputes, IP theft investigations, regulatory inquiries and corporate internal investigations where the subject's mail history sits in a 2009 NSF archive nobody has touched in a decade. Sherlock's role in NSF e-discovery: producing-party export of structured JSONL forensic records for review-platform ingest, plus NSF to PST conversion for review workflows that prefer native Outlook import; receiving-party read-only verification of incoming productions before review begins.

Deleted NSF item recovery: when Notes users delete messages, the records typically move to a "Recycled" folder and only get purged from the underlying b-tree on a scheduled compaction. Sherlock detects deleted NSF items still present in the b-tree (Recycled folder content plus items marked for deletion but not yet purged) and surfaces them in the extracted output with a deleted-NSF flag. For NSF litigation that hinges on recovering deleted NSF content from a respondent's archive, this is the workflow. Sherlock does not perform deep-format carving of fully-purged b-tree pages (out of scope for a $297 forensic viewer), but the in-archive deleted NSF recovery covers the majority of NSF e-discovery and NSF litigation deleted-recovery needs.

For the parallel deleted-recovery discipline in the PST world see our deleted email recovery from PST guide. For the broader mid-market vs enterprise positioning context see our Cellebrite vs Magnet AXIOM 2026 comparison.

• Purpose-built Rust parser, one signed 6 MB executable, no Notes runtime
• Reads .nsf, .ntf, .nsg and mail.box formats
• HCL Notes 14 and back through legacy Domino databases
• Mail, contacts, calendar, journals and to-do extraction with preserved folder hierarchy
• NoteID/RRV identity resolution per document
• Smart-typed field rendering (dates as dates, numbers as numbers, text as text)
• Rich-text body rendering to readable text, not a raw blob
• Byte-perfect attachment extraction
• SHA-256 per artifact in exported manifest (v1.2.0)
• Chain-of-Custody manifest with source-bytes SHA-256 anchor (v1.2.0)
• Hash-anchored acquisition from source-bytes through per-artifact hashes for court-defensible chain (v1.2.0)
• 100% read-only by design
• 140 MB+ databases, 40,000+ documents tested
• Live filtering, full keyboard navigation, virtualized browsing
• Structured forensic JSONL export (every field decoded, body extracted, attachment manifest)
• NSF to PST conversion for Outlook import (v1.1.0)
• Encryption metadata surfacing (ITEM_SEAL, TYPE_SEAL, TYPE_SEAL2, TYPE_SEALDATA)
• EV code-signed (SSL.com, "Sherlock Forensics Ltd" publisher)
• Windows 10 and Windows 11 at launch
• Linux build on the roadmap

NSF migration is the workflow of moving Lotus Notes archives off Notes onto Microsoft 365, Outlook PST or another modern mail platform. Most organizations doing NSF migration at this point have legacy Notes archives but no active Domino license, no Notes client install and no budget to revive the HCL Notes stack just to extract data for migration. The typical NSF migration vendor path is Quest On Demand Migration or Microsoft FastTrack at $5 to $50 per mailbox, plus a Domino licensing footprint to enable the source-side extraction. The combined NSF migration cost gets ugly quickly.

The Sherlock NSF migration path in v1.1.0: NSF Viewer Forensic Edition exports a structured JSONL forensic record per email with full metadata (subject, from, to, date, body, attachment manifest and NoteID). JSONL ingests directly into review platforms (Relativity, Concordance, Logikcull, Reveal, Everlaw) and into custom analyst pipelines. Total NSF extraction cost: Sherlock $297 lifetime versus thousands of dollars per project with dedicated migration tools and Domino revival licensing.

Honest scope on NSF migration in v1.1.0: Sherlock handles the EXTRACTION plus JSONL forensic output side AND the direct NSF to PST conversion path. A direct NSF to PST conversion path that drops into Outlook and Microsoft 365 ships in v1.1.0 released 2026-06-07. For most legal-hold, regulatory archive and e-discovery NSF workflows, the JSONL plus NSF to PST output is the load-bearing deliverable: it is what review platforms ingest and what downstream Outlook-based review workflows consume.

Related: see our how to open NSF files without a Notes client guide for the technical-buyer side of the workflow plus our PST Viewer for the downstream PST review tier once the NSF migration produces the PST artifact.

Why does Sherlock cost more than Kernel or Stellar?

Because we built features they did not. Kernel and Stellar are migration tools, their job ends when they hand you a PST. Sherlock Forensics NSF Viewer Forensic Edition is built for the examiner whose work starts before migration. Read-only by design, NoteID/RRV identity resolution per document, byte-perfect attachment extraction, structured JSONL forensic export and bounds-checked parser resilience are table stakes at the forensic tier and absent at the migration tier. The price reflects the scope.

Do I need Lotus Notes installed?

No. Unlike the rest of the NSF viewer market, Sherlock Forensics NSF Viewer Forensic Edition is built on a purpose-built Rust parser that runs standalone. No Lotus Notes, no HCL Notes, no IBM Notes, no Domino server, no MAPI runtime.

Does this work with HCL Notes and IBM Notes or just Lotus Notes?

All three. The .nsf file format is the same across IBM Lotus Notes (the original branding), IBM Notes (the rebrand) and HCL Notes (after the 2018 sale to HCL Technologies). HCL Notes 14 archives back through legacy Domino databases are supported.

Can I get an .nsf into Outlook or Office 365 without a PST writer?

v1.1.0 exports a structured JSONL forensic record per email AND a direct NSF to PST conversion for Outlook import with full metadata for review-platform and SIEM ingest. Direct NSF to PST conversion for Outlook import ships in v1.1.0 released 2026-06-07. For v1.1.0, the buyer ingests JSONL into the review platform OR uses the direct NSF to PST conversion (Relativity, Concordance, Logikcull, Reveal, Everlaw and similar all accept JSONL).

How does this compare to Cellebrite or Magnet Axiom?

Cellebrite UFED and Magnet Axiom are physical device extraction platforms costing $5,000 to $20,000+ annually. They serve law enforcement and high-end DFIR teams doing full mobile and disk imaging. Sherlock Forensics NSF Viewer Forensic Edition is a focused tool for one specific job: extracting and reporting on NSF email archives. If your case is a corporate Notes archive or a logically-acquired backup, you do not need Cellebrite for it.

What about encrypted NSF documents?

Sherlock detects sealed items via the ITEM_SEAL flag and surfaces TYPE_SEAL, TYPE_SEAL2 and TYPE_SEALDATA structure metadata where the format documents it. The number of sealed items in a document is reported. The wrapped content encryption key envelope is not publicly documented and cannot be decrypted without organizational key material.

One-time purchase or subscription?

One-time. $297 buys a lifetime license. Future major version upgrades within the same product line are included for the first two years from purchase. Forensic Edition is also unlocked instantly with an active Sherlock Forensics Suite license: one license, every tool.

Is Sherlock NSF Viewer a Lotus Notes alternative for migration?

Yes, on the extraction side. NSF migration off Lotus Notes onto Microsoft 365 typically requires either reviving Domino licensing plus the Notes client or buying a dedicated migration tool like Quest On Demand or Microsoft FastTrack at $5 to $50 per mailbox. Sherlock is a $297 Lotus Notes alternative for the extraction half: v1.1.0 NSF Viewer reads NSF archives standalone and exports a structured JSONL forensic record per email. Honest scope: a direct NSF to PST conversion that drops into Outlook ships in v1.1.0 released 2026-06-07. For review-platform ingest (Relativity, Concordance, Logikcull, Reveal, Everlaw) JSONL is the load-bearing format and ships today.

Can Sherlock NSF Viewer be used for e-discovery and litigation?

Yes. NSF e-discovery workflows use Sherlock at two points: producing-party export of structured JSONL forensic records for review-platform ingest (Relativity, Concordance, Logikcull, Reveal, Everlaw, Disco), plus receiving-party read-only verification of incoming NSF productions before review starts. For review platforms that prefer native MAPI input the NSF to PST conversion drops the same data into an Outlook-importable PST.

Can Sherlock recover deleted NSF items?

In-archive, yes. When Notes users delete messages, the records typically move to a Recycled folder and only get purged from the underlying b-tree on a scheduled compaction. Sherlock detects deleted NSF items still present in the b-tree (Recycled folder content plus items marked for deletion but not yet purged) and surfaces them in the extracted output flagged as deleted. Out of scope: deep-format b-tree page carving for fully-purged records (that requires specialized disk-image carving). For most NSF litigation deleted-recovery needs the in-archive deleted NSF detection covers what is reachable without going to full disk-image forensics.

What is the difference between Sherlock NSF Viewer and Kernel for NSF to PST?

Kernel for NSF to PST is a migration tool at $249 to $499 per tier. Its job ends when it hands you a PST. Sherlock NSF Viewer Forensic Edition at $297 lifetime is built for the examiner whose work starts before migration: standalone Rust parser with no Notes runtime, NoteID/RRV identity resolution per document, byte-perfect attachment extraction, structured JSONL forensic export and the NSF to PST conversion path for downstream Outlook review. If the workflow is "convert NSF to PST and move on," Kernel is sufficient. If the workflow is forensic NSF examination with structured downstream output, the Sherlock value proposition holds.

• How to Open NSF Files Without Lotus Notes (The Honest Guide), the technical guide to standalone NSF tools
• Sherlock NSF Viewer vs Notes the Ripper, peer-pricing forensic comparison