Forensic-Grade Lotus Notes Examination. No Notes Client Required.

Every other NSF viewer on the market markets the same promise: open .nsf files without the Notes client. Then you download one and hit the system requirements page: Lotus Notes 8.5 must be installed. IBM Notes 9 required. HCL Notes client recommended.

That promise is broken industry-wide.

Sherlock Forensics NSF Viewer Forensic Edition is built on a purpose-built Rust parser. There is no OLE wrapper around the Notes client. There is no MAPI dependency. There is no required HCL or IBM software on the workstation. A single signed executable that reads .nsf, .ntf, .nsg and mail.box files straight off disk. No installer, no dependencies, no runtime. It runs from a USB stick on an air-gapped examination workstation. Drop in a database from a 2008 Domino server or a 2026 HCL Notes 14 archive and read it. That is the entire promise. We deliver it.

Sherlock is a from-scratch NSF parser: not a wrapper around the Notes client, not a port of an existing NSF parser codebase. The Rust NSF parser reads the on-disk b-tree format directly so the workflow to read NSF documents requires no Notes runtime, no DLL loading, no licensing dependency on HCL or IBM. Examiners can read NSF archives from disk, from network shares or from forensic disk images interchangeably. As a Lotus Notes alternative for examiners and administrators with NSF archives but no active Lotus Notes seats, this is the practical answer. The same Lotus Notes alternative argument carries over to the M365 migration buyer, the e-discovery review buyer and the forensic examiner: an NSF parser that lets you read NSF data without paying for a Lotus Notes alternative seat or a Lotus Notes alternative migration suite is the focused tool for the job.

• Enumerate every document in the database. Tens of thousands of records surfaced in seconds.
• Real field names rendered, not cryptic codes. FirstName, InternetAddress, OfficeStreetAddress and the full schema as designed.
• Smart-typed values. Dates render as dates, numbers as numbers, text as text. Automatic.
• Rich-text bodies rendered to readable text. Read the actual message, not a blob.
• Attachments extracted byte-perfect with one click. Images, documents and the rest of the artifact set.

Handles 140 MB+ databases with 40,000+ documents without breaking a sweat. Virtualized browsing scrolls 42,000 records smoothly. Full keyboard navigation: arrows, Page Up, Page Down, Home, End. Live filtering: type and the list narrows instantly.

A reasonable question. Aryson NSF Viewer is $49. SysTools is $69. MailsDaddy starts at $99. Stellar Converter for NSF runs $149 to $399 across its tiers. Kernel for NSF to PST sits at $249.

Sherlock Forensics NSF Viewer Forensic Edition is $297. Higher than every commodity tool, higher than every migration tool. Comparable to Notes the Ripper ($349.95) and well below MailXaminer's hidden enterprise pricing.

Here is what you get for the difference that none of those products ship:

SHA-256 per artifact and Chain-of-Custody manifest (v1.2.0). v1.2.0 ships SHA-256-per-artifact verifiable export with source-bytes hash anchor. Every exported note and attachment carries a SHA-256 in the manifest. The acquisition is hash-anchored from source-bytes through per-artifact hashes for court-defensible chain across the full export.

Standalone Rust parser, no Notes runtime. The free NSF viewers quietly require Lotus Notes or HCL Notes to be installed. Migration tools the same. Sherlock reads .nsf, .ntf, .nsg and mail.box files off disk with no runtime dependency on IBM, HCL or Domino. Drop a database from a 2008 Domino server or a 2026 HCL Notes 14 archive in front of it and read the records.

NoteID/RRV identity resolution per document. Every note's NoteID/RRV is resolved through the BDB structure and validated against the corpus. If the parser cannot resolve a record to a coherent identity, it flags the discrepancy instead of guessing. No silent substitutions in the extracted output.

Byte-perfect attachment extraction. Attachments are extracted from the NSF without re-encoding, normalization or "helpful" cleanup. What gets written to disk is bit-for-bit what was stored in the source. The MIME types and original filenames are preserved.

Forensic-resilience by design. Malformed templates, partially-uninitialized records, fresh-template garbage, deliberately-corrupted superblocks. The parser handles them with bounds checking rather than crashing. The tool you reach for on a hostile-source NSF should not crash on the artifact that matters.

Encryption metadata surfacing. Encrypted NSF documents are common in regulated industries. Sherlock detects sealed items, counts them and surfaces seal-structure metadata where the format documents it. Knowing what you cannot read is sometimes more important than reading it.

Structured forensic JSONL export and NSF to PST. Every record is exported as a structured JSONL row with subject, from, to, date, body, attachment manifest and NoteID. Relativity, Concordance, Logikcull, Reveal and Everlaw ingest the format directly. The NSF to PST path drops the same data into an Outlook-importable PST for review workflows that prefer native MAPI.

The summary on the value proposition: Sherlock at $297 lifetime delivers a standalone NSF parser with NoteID/RRV identity resolution, byte-perfect attachment extraction, JSONL forensic export and NSF to PST conversion. The commodity tier at $49 to $99 ships none of that capability set. Pay the difference if your workflow requires reading NSF without Lotus Notes seats and producing structured forensic output for downstream review. Pick the commodity tier if your need is one-off NSF browsing on a workstation that already has the Notes client installed.

NSF e-discovery is the workflow of producing or receiving Lotus Notes archives under litigation hold. NSF litigation work covers civil cases involving employment disputes, IP theft investigations, regulatory inquiries and corporate internal investigations where the subject's mail history sits in a 2009 NSF archive nobody has touched in a decade. Sherlock's role in NSF e-discovery: producing-party export of structured JSONL forensic records for review-platform ingest and NSF to PST conversion for review workflows that prefer native Outlook import; receiving-party read-only verification of incoming productions before review begins.

Deleted-note recovery, honestly scoped. Sherlock works two layers. In-archive: it surfaces deleted notes still present in the b-tree, Recycled-folder content and items marked for deletion but not yet purged, flagged as deleted. Carved: version 1.2.75 carves note records that enumeration never reached, with checkpointing so a cancelled scan resumes where it stopped. Carved records are labelled candidates throughout. They are searchable, YARA-scannable and exportable, always as candidates, never presented as identified notes. It also builds a chronology of deleted notes and a salvage diagnosis for a database that will not open. What it does not reach, it says: recovery below the archive at the physical disk-image layer is a separate discipline and out of scope for this tool.

• Chronology of deleted notes. A time-ordered view of notes flagged deleted, spanning both in-archive deleted items and carved candidates. Candidates are labelled as candidates in the chronology and are never merged into the confirmed record.
• Salvage diagnosis. When a database will not open, Sherlock reports what structure it could read and what it could not, and why, rather than failing silently. The diagnosis is a coverage statement, not a guarantee of recovery.

For the parallel deleted-recovery discipline in the PST world see our deleted email recovery from PST guide. For the broader mid-market vs enterprise positioning context see our Cellebrite vs Magnet AXIOM 2026 comparison.

• Purpose-built Rust parser, a single signed executable, no installer or Notes runtime
• Reads .nsf, .ntf, .nsg and mail.box formats
• HCL Notes 14 and back through legacy Domino databases
• Mail, contacts, calendar, journals and to-do extraction with preserved folder hierarchy
• NoteID/RRV identity resolution per document
• Smart-typed field rendering (dates as dates, numbers as numbers, text as text)
• Rich-text body rendering to readable text, not a raw blob
• Byte-perfect attachment extraction
• SHA-256 per artifact in exported manifest (v1.2.0)
• Chain-of-Custody manifest with source-bytes SHA-256 anchor (v1.2.0)
• Hash-anchored acquisition from source-bytes through per-artifact hashes for court-defensible chain (v1.2.0)
• 100% read-only by design
• 140 MB+ databases, 40,000+ documents tested
• Live filtering, full keyboard navigation, virtualized browsing
• Structured forensic JSONL export (every field decoded, body extracted, attachment manifest)
• NSF to PST conversion for Outlook import
• Encryption metadata surfacing (ITEM_SEAL, TYPE_SEAL, TYPE_SEAL2, TYPE_SEALDATA)
• EV code-signed (SSL.com, "Sherlock Forensics Ltd" publisher)
• Windows 10 and Windows 11 at launch
• Linux build on the roadmap

Search

• Database-wide keyword search (Find in NSF) with phrase and regex modes, a keyword-list paste box and search history. Hit highlighting, sortable findings and CSV export.
• Search reaches inside archive attachments and states what it could not reach, so an item it did not search is reported as unsearched, not as a clean miss.
• Cross-NSF search runs over several databases at once.

Export and conversion

• NSF to PST, single-note EML and Outlook .msg, and bulk export of the filtered view one file per note. Message class is derived per note, so not everything is labelled mail, and recipients, original internet headers and HTML bodies carry across. A conversion-fidelity record travels with the export.
• Verifiable export container. Every exported artifact carries its own SHA-256 in the manifest. Those per-file hashes are bound into a single Merkle-root value that also changes if a file is renamed, removed or reordered, which the per-file list alone does not catch. An Ed25519 seal with RFC 3161 timestamping covers both. The root is a summary of the per-file hashes, not a second mechanism. It is omitted when the container holds no files, because a root over nothing would be a constant that looks like a measurement.

Analysis

• Static structural analysis. Static structural analysis of attachments and bodies. It emits a list of findings and never a verdict. Each finding is a severity, a title and a detail. Severity runs INFO, UNEXAMINED, WARNING and CRITICAL. Even CRITICAL is a structural statement, not a malware call: a Windows-executable finding says the content runs native code on a double-click, which is a fact about the file, not an accusation. An empty finding list means nothing was flagged, never that the item is clean. UNEXAMINED is ranked above INFO on purpose, so a coverage gap outranks a routine observation: an encrypted archive, an unparseable format, bytes never extracted, anything past the 64 MB or 2,000-entry cap, each produces an explicit finding that says it was not examined. Nothing is executed and nothing is written to disk. Archives are enumerated in memory, never extracted.
• YARA scanning over attachments, note bodies and carved candidates, with the ruleset identity and version recorded alongside every hit.
• Timeline histogram from note activity dates, clickable to filter and CSV-exportable. Comm-map correspondent graph from senders and recipients, with per-contact message lists.
• Attachment inventory with images rendered in place, sender authentication from retained internet headers, and a raw item explorer for note fields.

Evidence integrity

• A chain-of-custody action log with a CSV filing copy and a custody report section.
• The PDF report records the producing binary and whether that binary still verifies. When a note declares more fields than were recovered, the report names them rather than showing fewer.
• Marks persist per evidence item keyed by UNID, across multi-database cases.

NSF migration is the workflow of moving Lotus Notes archives off Notes onto Microsoft 365, Outlook PST or another modern mail platform. Most organizations doing NSF migration at this point have legacy Notes archives but no active Domino license, no Notes client install and no budget to revive the HCL Notes stack just to extract data for migration. The typical NSF migration vendor path is Quest On Demand Migration or Microsoft FastTrack at $5 to $50 per mailbox and a Domino licensing footprint to enable the source-side extraction. The combined NSF migration cost gets ugly quickly.

The Sherlock NSF migration path: NSF Viewer Forensic Edition exports a structured JSONL forensic record per email with full metadata (subject, from, to, date, body, attachment manifest and NoteID). JSONL ingests directly into review platforms (Relativity, Concordance, Logikcull, Reveal, Everlaw) and into custom analyst pipelines. Total NSF extraction cost: Sherlock $297 lifetime versus thousands of dollars per project with dedicated migration tools and Domino revival licensing.

Honest scope on NSF migration: Sherlock handles the EXTRACTION and JSONL forensic output side AND the direct NSF to PST conversion path. A direct NSF to PST conversion path that drops into Outlook and Microsoft 365 shipped 2026-06-07. For most legal-hold, regulatory archive and e-discovery NSF workflows, the JSONL and NSF to PST output is the load-bearing deliverable: it is what review platforms ingest and what downstream Outlook-based review workflows consume.

Related: see our how to open NSF files without a Notes client guide for the technical-buyer side of the workflow and our PST Viewer for the downstream PST review tier once the NSF migration produces the PST artifact.

• How to Open NSF Files Without Lotus Notes (The Honest Guide), the technical guide to standalone NSF tools
• Sherlock Forensics NSF Viewer vs Notes the Ripper, peer-pricing forensic comparison