An OST (Offline Storage Table) file is a local cached copy of your Exchange or Office 365 mailbox that Outlook creates on your computer. It stores emails, contacts, calendar items and tasks so you can work offline. Unlike PST files, OST files are tied to a specific Exchange profile and cannot normally be opened on another machine or without the original account.

Why can't I open an OST file normally?

OST files are bound to the Exchange or Office 365 profile that created them. Microsoft designed them as local cache files, not portable archives. If the Exchange account is deactivated, the employee leaves or the Exchange server is decommissioned, Outlook refuses to open the OST because it cannot sync with the original profile. Sherlock Forensics OST Viewer bypasses this restriction by reading the underlying MS-PST format directly.

Do I need Exchange to open an OST file with Sherlock?

No. Sherlock Forensics OST Viewer opens OST files without Exchange Server, Office 365 or Microsoft Outlook. It reads the MS-PST binary format directly using its own parser. No active mailbox connection required.

Is Sherlock Forensics OST Viewer the same as PST Viewer?

Yes. Sherlock uses the same application for both formats. OST and PST files share the same underlying MS-PST binary format. When you open an OST file, the viewer auto-detects the format and loads it the same way it loads a PST file. The download is the same executable.

Can I recover emails from an employee who left?

Yes. This is one of the most common use cases. When an employee leaves and their Exchange or Office 365 account is deactivated, the OST file on their workstation becomes inaccessible through Outlook. Sherlock Forensics OST Viewer opens the file directly, letting you browse and search all cached emails, contacts and calendar items without reactivating the account.

Can I use Sherlock Forensics OST Viewer for litigation hold?

Yes. When litigation requires preserving employee email from deactivated Exchange accounts, Sherlock Forensics OST Viewer opens the cached OST files in read-only mode. The Forensic Edition generates forensic reports with per-message SHA-256 hashing and chain of custody documentation suitable for court submission. Built by CISSP, ISSAP, ISSMP certified examiners.

Free Download

Sherlock Forensics OST Viewer Open OST Files Without Exchange

Q: Can Sherlock open OST files from Office 365?

Sherlock Forensics OST Viewer opens most Office 365 cached OST files. Very recent Office 365 cached OSTs with Exchange-specific encryption may not parse fully. Standard cached-mode OST files from Office 365 open without issue.

Employee left the company? Exchange decommissioned? Office 365 account disabled? Open the OST file anyway. SHA256 verified. CISSP certified. Since 2006.

Sherlock Forensics OST Viewer is a free Windows application that opens Outlook OST (Offline Storage Table) files without Exchange Server or Office 365. It bypasses the profile-lock restriction on cached mailbox files, letting you browse emails, contacts and calendar items from deactivated accounts. SHA256 hash verification included. Forensic Edition at $67 USD adds forensic reporting and chain of custody logging.

Also supports PST files. See our dedicated PST Viewer page.

Compare all pricing

Background

What Is an OST File?

An OST (Offline Storage Table) file is a local cached copy of an Exchange or Office 365 mailbox. Outlook creates it automatically so users can read and compose email while disconnected from the server. The OST syncs with Exchange when connectivity resumes.

Every Outlook installation connected to Exchange or Office 365 in cached mode creates an OST file on the local machine. This file contains a full copy of the mailbox: emails, contacts, calendar entries, tasks and notes. The OST file format uses the same underlying MS-PST binary structure as PST files.

The critical difference between OST and PST is portability. PST files are standalone archives you can copy between machines. OST files are locked to the Exchange profile that created them. Microsoft designed this restriction to prevent unauthorized access to cached mailbox data. In practice, it creates a serious problem when the Exchange profile no longer exists.

The Problem

Why OST Files Won't Open

Outlook refuses to open an OST file unless it can authenticate against the Exchange profile that created it. When that profile is gone, the data is trapped. Common scenarios where this happens:

Employee departure: The employee's Exchange or Office 365 account is deactivated. Their workstation still contains the OST file with months or years of cached email. Outlook will not open it.
Exchange server decommissioned: Organizations migrating from on-premises Exchange to Office 365 decommission the old server. OST files created by the old Exchange profiles become inaccessible.
Office 365 migration: Migrating between Office 365 tenants or switching from Exchange to another platform orphans existing OST files. The new profile does not match the old cache.
Litigation hold: Legal counsel issues a preservation order on employee email. The employee's account is already deactivated. The OST file on the workstation is the only remaining copy of cached correspondence.
Account compromise recovery: A compromised account is disabled for security. The local OST file preserves the mailbox state before and during the compromise for forensic analysis.

Solution

How Sherlock Opens OST Files

OST and PST files share the same underlying binary format: MS-PST. Sherlock reads this format directly using its own parser. It does not rely on Outlook, Exchange or any Microsoft component. When you open an OST file, Sherlock auto-detects the format, parses the node database and B-tree structures and presents the full folder hierarchy with all messages, contacts and calendar items.

The same executable handles both OST and PST files. There is no separate download. The viewer identifies the file type automatically and loads accordingly.

Note: Very recent Office 365 cached OSTs with Exchange-specific encryption may not parse fully. Standard cached-mode OST files from Exchange 2010 through Office 365 open without issue. If you encounter an encrypted OST, contact us for assistance.

Under the Hood

OST File Format Internals

Sherlock reads the OST binary structure directly, not through the Outlook MAPI runtime. Understanding the format helps explain what the parser actually does and where the forensic depth comes from.

Page structure

An OST file is a series of fixed-size pages. The original ANSI format used 512-byte pages with 32-bit offsets; modern Unicode-format OST files (Exchange 2003+ and Office 365) use 4 KB pages with 64-bit offsets. Sherlock auto-detects the format on open and selects the correct page-size and offset-width path. Both ANSI and Unicode OST archives parse without manual configuration.

Block B-Tree (BBT) and Node B-Tree (NBT)

Two parallel B-tree indexes anchor the on-disk structure. The Block B-Tree maps block identifiers to physical disk offsets so the parser can locate each block on-demand. The Node B-Tree maps logical node identifiers (messages, folders, attachments) to the blocks that contain them. Together they form the address-resolution layer that lets a forensic reader randomly access any record in the database without a sequential scan.

Heap-on-Node and property tables

Inside each node, messages and folders use a Heap-on-Node (HN) layout that contains the property table, the property-context and the actual property values. Sherlock walks the HN to extract every property (subject, from, to, date, body, attachment manifest, MAPI-id fields) without losing the original on-disk byte layout. Byte-perfect property extraction is what enables the per-message SHA-256 hashing pipeline downstream.

Compressed RTF body decompression

Exchange and Office 365 commonly store the message body in PR_RTF_COMPRESSED with the LZFu or MELA compressed-RTF format. Without RTF decompression the preview and exports come out blank. Sherlock decompresses the RTF and renders the actual body content in preview, search and every export format. This fix was shipped in v1.3.1 after Echo source-traced the Exchange and eDiscovery export blank-body cases.

Modern OST format support

Outlook 2013 forward writes OST files in the 4 KB-page PFF variant with cached-Exchange and Microsoft 365 connectivity modes. Sherlock natively supports this modern OST layout without converting or re-formatting the source. Acquired-from-the-field OST archives parse identically to OSTs from current Outlook installations.

Compare

Free vs Pro

Feature	Free	Pro ($67)
Open OST/PST files	Yes	Yes
View emails, contacts, calendar	Yes	Yes
Search within OST	Yes	Yes
SHA256 hash verification	Yes	Yes
Export to EML/MSG	No	Yes
Batch export	No	Yes
Forensic report generation	No	Yes
Chain of custody logging	No	Yes
Priority support	No	Yes
Court-ready PDF reports	No	Yes
Per-message SHA-256 hashing	No	Yes
Sender IP attribution	No	Yes

Deleted-email recovery on OST

Recover Deleted Emails from OST Files

OST files are the offline cache for Outlook plus Exchange or Microsoft 365 accounts. The OST file synchronizes with Exchange on a schedule; when items are deleted from Exchange, they are typically purged from the OST during the next sync. But the OST file retains the binary record of deleted items in deallocated B-tree pages similar to PST. Many examiners search for "recover deleted emails from OST" because the source mailbox has been server-side-purged by IT, retention-policy-expired or hard-deleted past the Recoverable Items dumpster window. The OST on the workstation often holds the recoverable copy.

Sherlock Forensics OST Viewer uses the same four carving methods on OST files that the PST Viewer uses on PST archives:

Deleted Items folder enumeration. Surfaces soft-deleted messages still in the OST's Deleted Items folder, even when Exchange has already purged them server-side.
Recoverable Items dumpster scan. Surfaces hard-deleted messages in the 14 to 30 day local OST dumpster, independent of the Exchange-side dumpster state.
B-tree page scan. Surfaces messages whose folder reference was deleted but whose binary body remains in deallocated OST node pages, including emails that aged past Exchange-side dumpster retention.
Slack-space carving. Surfaces fragments of permanently purged emails between allocated OST pages, including remnants from Exchange-side mailbox compaction events. The slack-space carving works on permanently purged OST records that have been overwritten only partially.

The OST deleted item recovery surface is especially valuable for three scenarios:

Exchange auto-purge scenarios. When Exchange retention policy purges items from the server, the OST may still hold them locally if the next sync has not completed. The window is small (often minutes to hours) but it does happen and forensic examiners receiving the workstation OST capture the data Exchange has already lost.
Terminated-employee mailbox recovery. Forensic examiners often receive an orphaned OST file from a terminated employee's workstation before IT decommissions the Exchange account. The OST captures messages that would otherwise be purged by Exchange retention or hard-delete cycles on the server side.
Legal hold and litigation hold OST analysis. The OST may contain emails that have been hard-deleted from Exchange by a custodian trying to obstruct discovery but are still recoverable from the OST cache locally. The four carving methods surface the deleted Outlook items the user thought were gone.

The recover deleted emails workflow on OST files is identical to the recover deleted emails workflow on PST files because the OST file is structurally the same MS-PST B-tree format. Even permanently purged OST messages that Exchange auto-compact has flagged as gone often remain recoverable through the B-tree page scan until the local OST compact runs. For step-by-step recovery methodology see how to recover deleted emails from PST files; the same workflow applies to OST.

Workflow

Orphan OST Forensic Workflow

An OST becomes orphaned when the Exchange profile that created it no longer authenticates. The mailbox data is still on disk. Outlook just refuses to open it. Sherlock bypasses the Outlook authentication path and reads the OST directly. Five scenarios where this is the daily reality for forensic and IT practitioners:

Employee separation, account deactivated: HR cuts the Active Directory account on the day of separation. The OST file is still on the workstation. The Exchange profile that created it cannot be re-authenticated. Sherlock opens the OST directly. The mailbox history is recoverable for the legal-hold or HR-investigation review.
On-premises Exchange to Office 365 migration: The old Exchange server is decommissioned. OST files created against the old server are orphaned the moment the server is retired. Sherlock reads them in their original on-disk state without recreating the legacy server.
Office 365 tenant migration: Merger and acquisition workflows commonly move users between Office 365 tenants. The old tenant identity is gone after the cut-over. Pre-migration OST archives are unreachable through Outlook. Sherlock reads them.
Forensic disk image, no live system: The workstation is a forensic disk image not a running machine. Mount the image read-only with OSFMount or FTK Imager or Linux losetup, point Sherlock at the mounted OST path, extract the artifacts. The original disk image stays untouched throughout. For the acquisition step itself see Sherlock Forensics Disk Imager. The Disk Imager handles drive-level acquisition with bad-sector tolerance plus 3-pass verification before the OST examination begins.
Crashed Outlook profile recovery: The Outlook profile is corrupted but the OST file itself is intact. Microsoft scanpst.exe and scanost.exe may refuse to run against the file. Sherlock reads the OST without requiring Outlook profile repair.

The forensic workflow across all five scenarios converges on the same pattern. Acquire the OST file in a read-only manner (workstation copy or disk-image mount). Open in Sherlock. Extract the artifacts. Verify integrity with the SHA-256 per-message hash pipeline. Export via the Forensic Edition to the review-platform of choice (EML and MSG for client-side review, JSONL for Relativity, Concordance, Logikcull and similar ingest).

Examiner detail

OST vs PST Forensic Differences

OST and PST share the underlying MS-PST binary structure but the operational and forensic semantics diverge in ways that matter for evidence review.

Storage location

OST files live in the Outlook profile directory under %LocalAppData%\Microsoft\Outlook. Each Exchange account creates exactly one OST per profile. PST files live wherever the user pointed them on a one-time basis (Documents, secondary drive, network share). For acquisition planning the OST is found at a deterministic path. The PST requires file-system enumeration to locate.

Sync behavior and delete semantics

OST is a cache. When the user deletes an email through Outlook the local OST flags the record as deleted plus the Exchange server commits the same deletion when connectivity resumes. PST has no server-side correlation. Deletion in a PST is purely local. The forensic implication is that an OST acquired after the user has been disconnected from Exchange may contain different deleted-record state than the server-side mailbox. Both sides matter for litigation.

Slack space and unallocated pages

OST and PST both leak deleted-record content into unallocated B-tree pages and slack space within blocks until Outlook auto-compact runs. Sherlock's deleted-item recovery applies the same four carving methods to both formats: Deleted Items enumeration, Recoverable Items dumpster scan, B-tree page scan for deallocated message bodies and slack-space carving for fragmented remains. The recovery surface is identical across OST and PST archives.

Forensic acquisition order

For a litigation hold or IR case involving an Exchange-connected workstation the recommended order is: (1) acquire a forensic disk image of the workstation with Sherlock Forensics Disk Imager for chain-of-custody integrity, (2) mount the image read-only, (3) point Sherlock at the OST inside the mounted image. This preserves the original workstation state, captures any disk-level artifacts and isolates the OST examination from the running system.

Pro Edition forensic capability across OST and PST

The same executable handles both formats so the Forensic Edition capabilities apply uniformly: SHA-256 per-message hashing, chain-of-custody logging via the verifiable container pipeline, four-method deleted-item recovery (B-tree zombie, heap-on-node, unallocated-space, compressed-RTF body recovery), MAPI property explorer, activity timeline with anomaly detection, communication map, cross-archive search, attachment safe view, pattern-based sensitive-data scan (credit card, SSN and passport pattern detection) and the v1.3.4 opt-in raw-body diagnostic for support-case decoder loops. A mixed OST plus PST production set is examined and exported in a single workflow.

Why the $67

Pro Edition Forensic Differentiators

Kernel for OST to PST is $249. Stellar Converter for OST is $99 to $399 per tier. Aryson is $69. SysTools sits at $99. The commodity tools handle the read-OST-and-display step. None of them produce the forensic infrastructure required when the workflow has to survive cross-examination, an opposing-counsel verification pass or a court declaration. Sherlock Forensics OST Viewer Forensic Edition at $67 lifetime delivers the forensic surface the commodity tier does not ship.

Court-ready forensic PDF reports

The Forensic Edition emits a branded forensic PDF with cover page, source-file metadata, artifact inventory, SHA-256 verification table, examiner attestation block and chain-of-custody footer on every page. The PDF generation pipeline is implemented in pure Rust against the printpdf crate (Echo's source audit confirms `report.rs` `PdfDocument::new` plus `write_title_page` and `write_email` are real PDF emitters, not stubs). The format is what e-discovery review platforms expect to ingest and what courts expect to see attached to a declaration.

Per-message SHA-256 hashing

Each email, attachment, contact record and calendar item is hashed at extraction. The hash is stored alongside the artifact in both the JSONL export and the PDF report. Re-extract the same OST file a year later and the hashes match. Proof the source was not altered between examination and production. Implementation: `hashing.rs` plus the verifiable container pipeline (`verifiable_container.rs`) walks each record and emits the cryptographic fingerprint as part of the standard extraction workflow.

Sender IP attribution from RFC-822 headers

The Forensic Edition parses Received headers from every message and extracts the source IP plus originating host. This anchors authorship attribution in phishing investigations, BEC litigation and insider-threat cases where the email-server-side audit log is unavailable but the message itself preserves the path. Implementation: `parse_received_attribution()` in `report.rs` extracts the IP plus host fields, wired through `eml.rs` for the export path. Commodity OST viewers do not attempt header forensics.

Chain-of-custody logging

Every artifact extracted from an OST file is tracked with timestamp, source-file hash, examiner identity and export destination. The log appends to the PDF report and exports as a separate signed audit document. The signed audit survives evidentiary review. Implementation: `chain_log.rs` is an append-only operation log that records every EXPORT_PDF, EXPORT_EML, EXPORT_JSONL and EXPORT_MSG action with full provenance.

Deleted-Item recovery via four carving methods

B-tree zombie recovery for soft-deleted records still flagged in the index, Heap-on-Node recovery for nodes whose blocks are still allocated, Unallocated-space carving for fragments in deallocated B-tree pages and Compressed-RTF body recovery for orphaned message bodies that lost their headers. The four methods run as a single scan and surface recovered items in a dedicated view with provenance flags so the examiner knows which method recovered which record.

Honest scope on what Pro adds vs the commodity tier

What the commodity tier does well: open an OST, list folders, view messages, dump to a flat file. What it does not ship: cryptographic per-message hash, chain-of-custody log, court-ready PDF, sender IP attribution, deleted-item recovery beyond Deleted Items folder enumeration, sensitive-data scanning, MAPI property explorer, communication-map graphing, activity-timeline anomaly detection, opt-in raw-body diagnostic for support-loop decoder cases. Pay the $67 difference if your workflow has any of those requirements. Pick the commodity tier if your need is one-off OST browsing without admissibility expectations.

Pricing

One-Time Payment. Yours Forever.

Pro License

$67 USD

Single machine license. No subscription. One-time payment. Yours forever.

All free features included
Export to EML/MSG formats
Batch export entire OST archives
Forensic report generation
Chain of custody logging
Priority email support
Try the free version before you buy

5+ machines? Contact us for volume pricing.

Use Cases

Who Uses Sherlock Forensics OST Viewer

IT Administrators

An employee leaves and their Office 365 license is reclaimed. Six months later, someone needs an email from that person's mailbox. The OST file is still on the old workstation. Sherlock opens it without reactivating the account or purchasing another license.

Litigation Support

Legal hold requires preserving all email from a custodian whose Exchange account was deactivated before the hold was issued. The OST file on their machine is the only copy. Sherlock opens it in read-only mode with SHA256 verification for evidentiary integrity. Pairs with our expert witness services.

Exchange Migration Teams

Decommissioning on-premises Exchange for Office 365 leaves orphaned OST files across hundreds of workstations. Sherlock lets migration teams verify that cached data matches the migrated mailboxes before formatting old machines.

Forensic Examiners

Incident response often requires examining cached email from compromised or disabled accounts. The OST file preserves the mailbox state at the time of compromise. Sherlock provides read-only access with hash verification for forensic investigations.

HR Investigations

Internal investigations into harassment, policy violations or data theft frequently involve reviewing a former employee's email. When the Exchange account is gone, the OST file is the only remaining source. Sherlock opens it without involving IT infrastructure changes.

Guide

How to Open an OST File

Download Sherlock Forensics OST ViewerDownload the free installer from this page. Under 5 MB. SHA256 hash: 840dc36454804372fa5fc446f21975ca8f2c99585dbdf6524dbad5da39f8adbc
Install and LaunchRun the installer on Windows 10 or 11. No admin privileges required. Launch from the Start menu.
Locate the OST FileOST files are typically stored in C:\Users\[username]\AppData\Local\Microsoft\Outlook\. Look for files with the .ost extension.
Open and BrowseClick Open File and select the OST file. Sherlock auto-detects the MS-PST format and loads the folder structure. Browse cached Inbox, Sent Items, Contacts and Calendar.
Search, Verify and ExportUse full-text search to find specific emails. View SHA256 hashes for integrity verification. Pro users can export to EML/MSG and generate forensic reports.

Questions

OST Viewer FAQ

What is an OST file?

An OST (Offline Storage Table) file is a local cached copy of your Exchange or Office 365 mailbox. Outlook creates it automatically so you can work offline. It stores emails, contacts, calendar items and tasks. Unlike PST files, OST files are tied to the Exchange profile that created them and cannot be opened on another machine through Outlook.

Why can't I open an OST file in Outlook?

Outlook requires the original Exchange or Office 365 profile to open an OST file. If the account has been deactivated, the server decommissioned or the profile removed, Outlook will refuse to open the file. Sherlock Forensics OST Viewer bypasses this restriction by reading the MS-PST binary format directly.

Do I need Exchange or Office 365 to use Sherlock Forensics OST Viewer?

No. Sherlock Forensics OST Viewer opens OST files without Exchange, Office 365 or Microsoft Outlook. It uses its own parser to read the file format directly. No active mailbox, no Microsoft license, no server connection required.

Can Sherlock open Office 365 OST files?

Sherlock opens most Office 365 cached OST files without issue. Very recent Office 365 cached OSTs with Exchange-specific encryption may not parse fully. If you encounter a file that does not load, contact us for assistance.

Is the OST Viewer the same download as PST Viewer?

Yes. The same executable handles both OST and PST files. OST and PST share the same MS-PST binary format. The viewer auto-detects which type you opened and loads it accordingly. One download, both formats.

Can I recover emails from a former employee's OST file?

Yes. Locate the OST file on the former employee's workstation (typically in AppData\Local\Microsoft\Outlook). Open it with Sherlock Forensics OST Viewer. You can browse and search all cached emails without reactivating the Exchange or Office 365 account.

Can I recover deleted emails from an OST file?

Yes. Sherlock Forensics OST Viewer uses four carving methods to recover deleted emails from OST files: Deleted Items folder enumeration, Recoverable Items dumpster scan, B-tree page scan for deallocated message bodies and slack-space carving for fragmented remains. The recovery works on the same MS-PST binary format used in PST archives.

How do I recover deleted OST emails after Exchange sync?

If the OST has not completed sync with Exchange after the deletion, the deleted items often remain in the OST locally even after the server-side mailbox has purged them. The window is narrow (minutes to hours) but real. Forensic examiners capturing the workstation OST before the next sync recover messages Exchange has already lost.

Can I recover emails from a terminated employee's OST file?

Yes if you have legal authority for the recovery. The OST captured from the terminated employee's workstation often holds emails that have been server-side-purged by IT during the decommissioning cycle. Sherlock Forensics OST Viewer opens the orphaned OST and surfaces the four carving methods (Deleted Items, Recoverable Items dumpster, B-tree page scan, slack-space carving) on the local cache.

What happens to deleted OST items during Exchange sync?

Outlook flags the deleted items as deleted in the OST's B-tree index but does not immediately overwrite the binary body. The next sync with Exchange may propagate the deletion server-side, but the binary body remains in deallocated OST pages until Outlook auto-compact runs locally. The B-tree page scan recovers these messages until compact.

Can I recover OST emails after a mailbox retention policy expired?

Yes if you have the orphaned OST file. Retention policy expiration purges from the Exchange server, not from local OST copies. Sherlock Forensics OST Viewer scans the local OST file for messages that have aged out of the Exchange-side retention window but remain in the OST cache locally.

Does the OST file save deleted items differently than PST?

Functionally similar: both use the same MS-PST B-tree page-level storage. The carving methods Sherlock uses (Deleted Items, Recoverable Items dumpster, B-tree page scan, slack-space carving) work identically on PST and OST file formats. The differences are operational (OST is the Exchange offline cache; PST is the user-authored archive) not structural.

Can I use the same license for PST and OST files?

Yes. The Sherlock Forensics PST/OST Viewer Forensic Edition license covers both PST and OST file formats. The software auto-detects the file type. One license, one machine, both formats. $67 USD one-time payment.

Can I use this for litigation hold?

Yes. Sherlock Forensics OST Viewer opens files in read-only mode, preserving evidentiary integrity. The Forensic Edition generates forensic PDF reports with per-message SHA-256 hashing and chain of custody documentation. Built by CISSP, ISSAP, ISSMP certified examiners with courtroom experience.

Get Started

Download Sherlock Forensics OST Viewer Today

Free for viewing, searching and hash verification. Pro at $67 USD for export, forensic reports and chain of custody logging. Built by the same team that delivers expert witness testimony and forensic investigations in Canadian courts. See also: email preservation for litigation and free PST viewer comparison 2026.

Since 2006CISSP, ISSAP, ISSMP certified888.883.4550

Sherlock Forensics OST Viewer is provided for lawful use. Terms of Service