Release History

Sherlock Forensics PST Viewer Changelog

Every release and its download verification (SHA-256), newest first. For the current download and product details see the Sherlock Forensics PST Viewer page.

v1.6.27 (2026-11-05): Attachment hashes in the PDF report, new Include attachments option

Attachment listing. The PDF report now lists every attachment of every message with its name, size and SHA-256.

New Include attachments option. Attached PDFs and images are reproduced as pages in the report. Every attachment is also saved in a folder beside the report, with a manifest.csv of their hashes.

1.6.27 installers Quick SHA-256 9265233c85d8505108d32c92084356f40162b3f113f72c940a1ba6104060e14b. Standard AI cbe90767848d67951aec7337c021ec15e7a2387fb5bbcff7eefa26740d97f457. High-accuracy AI 2b2f2c233cb1e4c4df51cb8edbf093a527972cd2d19916ff111aa2ca236f740d. macOS 13701d007f3e66516c70fbc32dfa282018edddb8dea9dee1ad6989eb4945264f. Linux 992827314f17bedf745138045176a5d1aab834a67d6d77449c2b89b88b12294c.

v1.6.26 (2026-10-21) - Bcc recipients shown on their own line, new bcc: search

Bcc fix. In PST and OST files, Bcc recipients were shown under To, so a blind recipient looked like a visible one. They now have their own Bcc line on the message's Evidence tab and in loose .msg and .eml previews. The PDF report already listed them correctly.

New bcc: search. Advanced query can search blind recipients only, for example bcc:[email protected]. It combines with other fields and needs Search full messages, the same as cc:.

Bcc only exists on the sender's copy (Sent Items, Drafts, Outbox). The mail server removes it before delivery, so it cannot be recovered from a recipient's Inbox.

1.6.26 installers Quick SHA-256 3301720b37e20ca05bdcc379c69b13011bbec6e71865bf84377a3bdda4073119. Standard AI b4b9a5a995e95938907fc2374a5ebc6bfe7087c4f9bb30d75ee3e78067aca41a. High-accuracy AI c8e309f17dff8cc4687afcc55eb3a1e809ba7c45fac2af01dac9f13a99c23698. macOS bdbf54b60abdf323bc188d8def18dd7412ef8eebc103ee6b94a5534b012e7722. Linux bb4b1ff49b88f4ea1e637b8048706bf5273f8024783a3b4fbe31cbb0fe063c96.

v1.6.25 (2026-10-14) - Opens refused files, Data Recovery fallback, date-range export

Files that were refused now open. A PST stamped with an unusual format version number, such as 22 written by some third-party tools, used to be refused. It now opens.

Unreadable files go to Data Recovery. A file whose structure cannot be read at all opens straight into Data Recovery, which recovers whatever messages are still in the raw bytes instead of stopping at an error.

New export option: leave out messages received before a date. The day starts at midnight in the display time zone set in Settings, and the left-out messages go in the withheld CSV with the reason for each.

Privilege fix: withheld attachments were leaking. With All except marked and the export set to Attachments only or Both, attachments from the withheld emails were still saved. They are not any more.

1.6.25 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 0a3b5705f2ff486fe074b26a956a4830877164ebf28364720fb4d92df6515272. Standard AI 7b720c9093b182b05957f38a752759543e940ace923c0524bd24a29daaacbb63. High-accuracy AI 56bd2ea852ce30ccc8726def9d2010902b265e231658d6b057fa6f32a64163da. macOS e899e874dd558d9a4262160afd03ad111daf5fdabf9deeaea8d78215f7420bc9. Linux a8f80a0f03dff1eb8ab4bb76e39bee66496defe23c54bb703b61ee94ab9f35e9.

v1.6.24 (2026-10-08) - Reads Mac Outlook (OLM) calendars

Sherlock Forensics PST Viewer 1.6.24 reads Mac Outlook calendars. Open your .olm as usual and click Calendar; there is no need to add or extract Calendar.xml.

Recurring series: OLM series now show on every date they fall on, at the same local time across daylight-saving changes. A moved occurrence shows at its new time, a deleted one is left out and a series with no end shows two years ahead with a note saying so. Every pattern matched the dates Outlook showed in a second test export.

Invitations in OLM mail: these now appear on the calendar, as they do for PST. This also fixed a real bug that affected PST files too. Outlook for Mac writes invitation calendar data with old-style Mac line endings, and the reader turned those into no event at all. That is fixed.

Codes: out of office is confirmed as code 3. How Outlook for Mac records your response to someone else's meeting is not yet confirmed, so those show as Response not recorded rather than a guess.

1.6.24 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 43a871a0a7f61e92e8eb836d31ce5375c6956bc0f0c7b39272b29a1511f7655b. Standard AI 00f7c5f44a1a158687cc6b696c51d58d01349a3adb671b778bf6e34a3aec0dae. High-accuracy AI d2b8811dfa3ee5679f2f267fe82c3cc442187d2a4ea1aac6e04b13154febdd9f. macOS e47927979428202dc7f0018e992f7c1180bbf7956ef655031948903487dfd835. Linux 52da2f3d1e96d5f891c13bde496c0fbe40f4400abb278fe197711d193ff51778.

v1.6.23 (2026-09-30) - Offline self-service seat release

Sherlock Forensics PST Viewer 1.6.23 adds offline self-service seat release, working with the portal changes shipped the same day. On an offline-activated machine, open About then Release seat to remove the activation and show a release code like 233-723. Enter that code with your license key under Manage your seats on the website to free the seat, so a license can move between air-gapped machines without contacting support. Machines activated online release directly as before. Offline activations now last 12 months, and renewal uses the same request file without taking a seat. Pricing and editions unchanged. Released for Windows, macOS and Linux, with the auto-updater payload live so existing customers get it via update.

1.6.23 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 b61a26ecf56406fdd88ed0d232662b66a5cf069ffe3eccc51e72dbf1c70a2b85. Standard AI 8f89d638d7fadc085877a26fd252f6138f93369af26cd5b2c5a48b1356d6e818. High-accuracy AI e90462a23c6c7aecaddefbcfcdeecc4ef54cd69da03afa41120635a1d863ad7f. macOS 1750ca95708d16832531befdcddb33416da3903453188f7542f76792ae0ac253. Linux c166acf48dd3c3a58dbf25753f33988b15295bb17482a0c65e915dd9abe00963.

v1.6.22 (2026-09-30) - Machine ID + check code in About

Sherlock Forensics PST Viewer 1.6.22 is a small support release. The About panel (the PRO or FREE chip at the bottom right) now shows this machine's ID and a check code with a copy button, on every install. This is the code an air-gapped customer quotes to free that machine's seat online from any connected machine, so a seat can be moved without the offline box needing to reach the network. No new features, pricing and editions unchanged. Released for Windows, macOS and Linux, with the auto-updater payload live so existing customers get it via update.

1.6.22 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 7db128c20ef5eee763382c542d0ed5f6bb1f0abe8c3eb21391d3578c9049fb8a. Standard AI 04d80154448f7c48da48a9d08465fa56d9e34c929bdb72382baaebb62eeafac4. High-accuracy AI 3649b30f7ce18b43ee0419672b13df1cc3a1509470e4f0606e6fcde5213d2066. macOS 265ff5cdc43db37406d72ad6712e755c644a255326da0ef43d7e865301785bf7. Linux 2ff97ae065bcb36794df7d624e5d41a5a1b864b862e982215c8e0f539ec2a749.

v1.6.21 (2026-09-30) - PST export reliability + self-service seat release

Sherlock Forensics PST Viewer 1.6.21 is a reliability + self-service release that includes the 1.6.20 changes. It hardens PST export against large distribution-list mail: a message with a very long To or Cc line (sent to hundreds of recipients) could previously stop a whole folder exporting, and a 2,402-message Inbox could produce no PST. That is fixed and the recipient line is kept whole. Messages with about 200 or more recipients or attachments were sometimes written into exported PSTs in a form that could not be reopened even though the export reported success. That is fixed. Attachments with no attachment method (common when a mail client stripped them) no longer stop an export, and where only the name and size survive the export says so plainly. If a single message cannot be exported whole it is kept as a flagged placeholder with the reason, listed in the report + a sidecar CSV, so the rest of the folder still completes, and a failed export now shows in red + is recorded in chain of custody + the diagnostics log. This was tested on a real 21,087-message Inbox that exported, reopened and re-exported whole. 1.6.21 also adds self-service seat release: a licensed customer moving to a new machine can click the PRO chip then Release seat to free their own seat, no support needed. No new features, pricing and editions unchanged. Released for Windows, macOS and Linux, with the auto-updater payload live so existing customers get it via update.

Re-export note: If you exported PSTs containing large distribution-list emails with an earlier version, re-export them with 1.6.21.

1.6.21 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 bad95d19c69770e9a3de531405a2b3a6339299edcd6fcf2ad15fef8b6dbf8b70. Standard AI 8f9d153789dad09dc192e618564a6c36bd63052551e9c6698d56d2f7f5b3d5af. High-accuracy AI e997aab191dc554da8d1a5841baa4958074a20f23f6c6b403656f189c4fa2312. macOS 91a05fd00fdd3929cfe428de19ebc0aec3da0fd99f25d5c53f726cd0b5bea189. Linux 07c92c2d46c67ba05034f98675800c9cb6e1e90bc68a15d5494b676ccd7e8e84.

v1.6.19 (2026-09-29) - Privilege withholding for eDiscovery

Sherlock Forensics PST Viewer 1.6.19 adds privilege withholding across a custodian's PST archives, and includes the 1.6.18 changes. Import the client review spreadsheet once and match it in a single pass against all of the custodian's PSTs, marking each privileged email in the PST that holds it. Export all except marked to a new PST, EML, MSG or mbox. Every withholding export writes a CSV listing each withheld message with its source archive, folder, date, sender, recipients, subject, attachment flag and item id, SHA-256 hashed into the export report and the chain of custody log. Exported + withheld counts are reconciled against the folder total with any gap reported, the export fails closed if the list cannot be written, and an empty list is still written when nothing was marked as the record that nothing was withheld. A combined match report flags any unmatched row so the reviewer can show every privileged row was caught. Every match is previewed and a subject line alone never marks a message. This release also fixes a crash searching damaged archives (a corrupted field could make the app try to reserve tens of gigabytes of memory) and a window that reopened as a tiny square after being closed while minimized. Pricing and editions unchanged. Released for Windows, macOS and Linux, with the auto-updater payload live so existing customers get it via update.

1.6.19 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 c1d902571b99c925d8a11b79c5885ce43603c9c145ade5215e4a924466a68a6f. Standard AI f164a3d1457f838faf6ea05df34528b8c078fc96ad03807373650c4713f872a4. High-accuracy AI 6c4a2b7baee03bd92b85c28277e917c1cc894760c3bd94e7a69395549269bf0d. macOS 4016013802f6736ffdc7529c6526dbba59d556c5bcf741f4fd0f7e5d723dab6f. Linux d0b047d46edbfd83c14f6b39657b548b6990bdddb265c7b2f2492dd610d6b672.

v1.6.17 (2026-09-27) - More robust on damaged archives

Sherlock Forensics PST Viewer 1.6.17 is a maintenance release that hardens Find in Archive against damaged PST and OST files. On some corrupted archives a bad size field could make the reader try to reserve tens of gigabytes of memory and the app could close. The reader now checks those sizes against the data actually present. A damaged item is reported as unreadable and the rest of the archive is still searched. Normal archives read exactly as before. No new features, pricing and editions unchanged. Released for Windows, macOS and Linux, with the auto-updater payload live so existing customers get it via update.

1.6.17 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 246bc041268cb09c5002101de32f84be71f3f69a8d431175d67aa3cc54825400. Standard AI cd2e3fefc5d74e8fd31b550233280ad35898f10fc0cd8778d13127009d1ee339. High-accuracy AI 3eb60f03933637ce3ad2ce1c1c78d7761f5c2888326bdecede608bfb1330c069. macOS 596a060c42c1b16b5e7f883f5340d9e69dfa1742724d196a9538854106b29868. Linux d294e5954ab18c6e151f05967bce578657fb3d03c78b6d798fa7470eb95f0316.

v1.6.16 (2026-09-27) - Available in 11 languages

Sherlock Forensics PST Viewer 1.6.16 adds a localized interface and PDF reports in 11 languages: English, Polish, Spanish, Chinese (Simplified), French, Portuguese (BR), Russian, German, Japanese, Indonesian and Turkish. Choose your language from the flag menu in Settings and the interface switches instantly, and reports export in that language. Evidence is never translated. Subjects, senders, bodies and folder names stay as found, and custody logs, manifests, exports and hash files stay in English so they verify identically lab to lab. Reports now render Cyrillic, Chinese, Japanese, Polish and Turkish evidence exactly as stored, so examiners with international mail should re-run older reports. The report SPF, DKIM and DMARC section now states the verdicts are what the receiving mail server recorded, not re-verified by the tool. Released for Windows, macOS and Linux, with the auto-updater payload live so existing customers get it via update.

1.6.16 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 9263735ab64fbafa7f040f7068494cf4e97e703e18fd94b6beb6d32f1eaf26f3. Standard AI 9fbc57f43be4cc628fb07df74c7299d3001fc415e384fa5c2ebab2c0b5b5a062. High-accuracy AI 4aa8662b71b92faba167f8d8734bf002db51c846ce6171938e4198966640d554. macOS 667d05f883de3a503d1d55d7d61f53f5eab681edece6cbbc04b3190d56ff740c. Linux 4eb7e37175f1edd5ff37efd329e917c91f430ff6288df100143a5f56b1ed1b10.

v1.6.14 (2026-09-25) - Loose .msg and .eml folders work end to end

Sherlock Forensics PST Viewer 1.6.14 makes a folder of loose .msg and .eml files (for example messages extracted from a discovery document) work with MARKED, the review spreadsheet importer, Find in Archive and Export. Export can build one PST from the folder with attachments, keeping its subfolders. Marks on loose messages are now saved. It also fixes a fast search that could be reported as interrupted. Released for Windows, macOS and Linux, with the auto-updater payload live so existing customers get it via update.

1.6.14 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 2eaa41b26e149c8868393258b4907913f6c3a8e319d4f3c3e8b526d6b3146936. Standard AI 1cbe7ae1ab894a555e96f3ea4da686d640c28818ebc69007f530e6fcf1460ff9. High-accuracy AI 0e5598774286d91efa2e6df2d709693891d90e7cc58a45ffcbf2819ca98729c8. macOS 7ec08005cf448af4be42ac194d272a6f570e2bfe0d639b7afbd60a95b03bc3c0. Linux 547aec4f6c042d034f0a6c9abd228eeac1e3ffb0e18be708130c530a7c0a6e8d.

v1.6.13 (2026-09-25) - Recovers messages whose index entry was lost

Sherlock Forensics PST Viewer 1.6.13 improves damaged and truncated PST recovery. It now rebuilds the bodies and attachments of messages whose index entry was lost. Earlier builds reported these as missing when the content was intact in the file. When a message genuinely has no recoverable body the viewer now states the reason instead of a blanket note. Folder names that survive but cannot be tied to a parent folder are now listed. Released for Windows, macOS and Linux, with the auto-updater payload live so existing customers get it via update.

1.6.13 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 d0cf52d9b41b8798fa95eea961dc21c91354430b39a40c5e485db8f55ce41d6d. Standard AI c02d1cd240300a2a3f6739265d1c54e47c490d2e50539f61aef1286a1c995250. High-accuracy AI 242318af7c6020be96a7680f9b274ac41db19d0952efcb8ef9c06d26d055f54c. macOS 694a1f6fd368c1ed95fd4724217a10055f44ca1257b76eb6efe467295459baca. Linux 166005b939c7ec25be03f66e54a59dfcf3d668361d0388ff4c27fb6e6c8c02ac.

v1.6.11 (2026-09-23) - MARKED redesigned as one collection

Sherlock Forensics PST Viewer 1.6.11 redesigns MARKED as one collection across archives, adds review-spreadsheet import and fixes a subject-line display bug. Released for Windows, macOS and Linux, with the auto-updater payload live so existing customers get it via update.

MARKED, one collection across archives. Emails marked in the open archive, in X-PST Search and in archives opened earlier all appear together, each archive colour-coded. Sort by any column: subject, from, to, date, size, attachments, archive, folder or when marked. Search covers subject, people, attachment names, folders and archive names, and filters narrow it to one archive or to emails with attachments. A live preview sits beside the list. Select emails with click, Shift, Ctrl or the keyboard, then export, copy as CSV or unmark them, and Unmark can be undone. Export asks for its scope: All marked, Shown or Selected; exporting from several archives writes one folder per archive and a single manifest. Each mark now records when it was made.

X-PST Search marks now reach MARKED (customer-reported). A mark on any archive's search result is saved against that archive's own SHA-256, so it is still there when that archive is opened later.

Import a review spreadsheet (.xlsx). Columns are detected from the header row, and rows can be filtered by a status column that defaults to the No and Partial catalog rows. Times are read in a chosen time zone, Arizona by default. An email matches a row only when both subject and time agree, and sender, recipients and attachment names then confirm the match. Every row is previewed as Confident, Ambiguous or Unmatched, and nothing is marked until the examiner confirms.

Fixed (customer-reported): a box character appeared in front of RE:, FW: and Fwd: subjects in the preview pane, MARKED and search results.

1.6.11 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 1ea782e92994cb861b9bd843ae79ca8f2672c2bb2f02e8b4e5eece8834df6621. Standard AI 316e6b69d7d7e2dd3b8328713f2b639be09a23d15a12ac54618e83b22446c294. High-accuracy AI b052ff412230cdb0e7a6d695ecbb8a35a03e147723eb8e50ad517fc6cf704365. macOS af25cacb7dec90982b82123d8cf934e1aa0b321a4b3df0789b2e51c7b9123683. Linux 7fb590e47e3758e7d6d0a8f1537746a81d5aa1cb7d7977e513665163270010d2.

v1.6.10 (2026-09-23) - Timezone fix and Arizona (MST)

Sherlock Forensics PST Viewer 1.6.10 fixes archive-search timestamps that displayed UTC instead of the selected timezone. It adds an Arizona (Phoenix) option under About > Display Timezone, correctly keeping Arizona on MST (UTC-7) year-round because Arizona does not observe daylight saving. Search timestamps now include seconds and the timezone abbreviation, so the customer example now displays 2023-03-15 16:24:55 MST. Original evidence timestamps remain unchanged.

1.6.10 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 5f9cb80eb0316e1699a1bd0ba4f914a4057c19e53066d1855f4161777c26442a. Standard AI bf693d87e07613a2c56da55ef518a7f8f2b7e5f57fe42225af5edcfe4328eee2. High-accuracy AI 5e17d255c3773e05d0b4f3b91b7b026344967e82abead314250cc011f6670dc6. macOS fe664aee3ade9c88f3cbb2199e20946c064340d8522ed9e7b1876056b025c9b6. Linux ba431f16fbba63b2bf48abb16eaf8a00858a6a41585839574c50d8c1409042a8.

v1.6.9 (2026-09-23) - Marked collection and export

Sherlock Forensics PST Viewer 1.6.9 adds MARKED to the sidebar with an archive-wide count and a review window, so emails marked across folders and searches accumulate in one collection. Export all marked writes a single Outlook PST or individual EML files, including attachments; view filters do not reduce the export scope, and exporting keeps the marks. Export is blocked if marked messages cannot be located, which prevents silent omissions. Mark persistence is improved: marks survive restarts and source-file moves; selections made during initial hashing are preserved; save or load errors are shown. This release also fixes attachment previews, Save and Save All choosing Windows 8.3 aliases such as SENTEN~1.pdf when the original long filename exists in the PST.

1.6.9 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 c9de495d1ff28c71246468d3baf0885cd3974009a78a937e9d052ef3be8cf8c9. Standard AI f1c12cdce3dc74e9d90922c14a777f0d7c286db4e32fc9459cf27f88f431bc1d. High-accuracy AI 5ee9aecb9602db7116e140152a4494f760229d54e9c9376c38fde9e8c46c92c3. macOS 03f560e0a5dab38cafae57aa43eaa9511b8457c27d1988ceb3b6185b14f67575. Linux 34a90b7321ff7ed9e1a475405b84ea53fe32a18e99834a688a7270b740bd0d0f.

v1.6.8 (2026-09-23) - Advanced query mode

Sherlock Forensics PST Viewer 1.6.8 adds an Advanced query mode to Find in Archive and X-PST Search, with Lucene-style syntax. Build precise queries with Boolean AND, OR, NOT, parentheses and field groups; field filters for subject:, from:, to:, cc:, body:, folder: and attachment:; quoted phrases, * and ? wildcards and has:attachment; and inclusive received-date ranges such as date:[2025-01-01 TO 2025-12-31], interpreted in UTC. Syntax errors are reported clearly, and a QUERY badge shows the complete expression in the results. Example: from:alice AND (subject:invoice OR subject:payment) NOT subject:draft. Advanced query mode reuses the existing index and search workers, and ordinary keyword search is unchanged. Cross-PST quick search uses indexed metadata, while full-message search covers bodies, email addresses and attachment filters. This is Lucene-style advanced search, not a full Apache Lucene implementation. Attachment filters match filenames, not attachment contents, and advanced queries exclude stored audio transcripts.

1.6.8 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 117d9ca1d6729a1def3203e901ab0e2e71c86866b06f7ef4381a10738cc60cbf. Standard AI 4c4531e9965f83123bc7b893a3929d1a5f1a2521275fdb06df7166e1f51dea69. High-accuracy AI a5c39e80726eb882bc05cd601acef48849961fa9f2454147b57f6477c8a2c049. macOS f64ca1428a8fe4404a68130a994708e4b6080afdefb81f8721778625ebf9f165. Linux 2fa9e9effd638e0b95b729e03f8574db95cf65a527a762cc1839491cf98879c0.

v1.6.7 (2026-09-23)

Sherlock Forensics PST Viewer 1.6.7 adds an Outlook-style calendar with day, week and month views, meeting details, response badges, overlapping meetings and all-day events. ICS invitations from messages appear muted with dotted outlines until matching acceptance is recorded. Calendar loading now shows progress, and users can jump directly to a year. Message headers always display SENT BY when recorded, with the earliest retained relay shown separately. This release also includes media-gallery improvements and fixes exported PSTs appearing as "Empty" in Outlook. Calendar limitations: UTC display; recurring series show their first stored occurrence. Unsupported or ambiguous invitation timezones remain undated.

1.6.7 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 16738567107d9d618d95ed8a6c547bb662c8403357161ae8ce018c09ee966eb7. Standard AI 943da620d800bb1ba36967218164b064b064a8b40742ec343a6516fb9ee57b1e. High-accuracy AI 3375119d29ba46b243fea779dc714c0aec433e25b45013844c226339a7a7d7b1. macOS e658361bdc0576e3d88ebb944e694dbb41ead5859a66ee84536f68bfde1df96f. Linux 9043e5920887bbab93b7cb287ec22817715868c9a5942fa51900fe62382e5a7e.

v1.6.5 (2026-09-19)

  • Attachment totals. Count attachments and their total size across a PST, with faster metadata counting, optional exact payload measurement, partial totals kept when cancelled and resume within the same session.
  • Cleaned PST exports. Produce one cleaned PST per source or combine multiple sources into one while retaining separate source folders. Apply attachment-type and threat-severity rules, with removal placeholders, CSV ledgers and export reports.
  • Source protection. Originals are opened read-only. Cleaning creates new files, refuses overwrites and verifies outputs before marking them complete.
  • Deeper threat inspection. 7-Zip and zstd support, nested archive inspection, decompression limits and explicit warnings about unexamined content. Script attachments are inspected for suspicious content without execution.
  • Offline activation. Activate air-gapped workstations using machine-bound request and response files, with clearer licensing and network errors.
  • Improved interface. Redesigned Archive Summary, Cleaned PST Copies, Scan Threats, search and review screens, with clearer progress and results.
  • Cross-platform fixes. Chinese, Japanese and Korean font support on macOS and Linux, corrected Linux dependencies and enforced glibc 2.35 compatibility.

Cleaning produces derivative archives; static checks do not certify retained attachments as safe.

1.6.5 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 40b295efc9fc56c34ca776eaadb7b796f878920d4c6e6101bfed2518af27c6fc. Standard AI acb3c722217cb42578ea2e177cec6dd1e0e1d7e854a47dfee1a81077368c7cd5. High-accuracy AI c15adb92038d4fa8390317753e4d8dad525f849aa99ba6f95c74264d4f758c2a. macOS 2e04f71aa3c1d69f8871822785523c95b55b939a88eb2a4fa145d009ff575ec2. Linux 6563c356bce7728daf3aa1b3e5d114e080ae37af48a69325a579e08e0fc4861b.

v1.6.2 (2026-09-05)

  • Reads Outlook for Mac (OLM) archives on Windows, macOS and Linux. Messages, folder tree, attachments, search, export and reports, including salvage of a damaged OLM archive whose index is gone.
  • Linux, the first ever release. A Debian package for Ubuntu 22.04 or newer, Debian 12 or newer and Kali on 64-bit Intel or AMD. The on-device AI features are Windows and macOS only.
  • On-device AI on macOS. The engine now downloads with the models in the same consent dialog.
  • Automatic activation. The app collects your license at startup, so there is no key to paste by hand.
  • Security: the updater verifies its download. It now refuses anything not signed by Sherlock Forensics Ltd before it swaps the binary.
  • Two interface fixes: the Forensic Edition preview no longer opens behind the main window, and its Activate and Buy buttons are no longer clipped without a scrollbar.

The last installer most customers could actually download was 1.5.12, so this is a bigger jump than the number suggests.

v1.5.13 (2026-08-31)

Select and copy text straight from any message preview. Highlight a passage with the mouse or by keyboard (Shift with the arrow keys, Ctrl+A to select all, Ctrl+C to copy), then paste it directly into your report. A new Copy message text button sits next to Copy raw source, and every step is documented under F1.

This restores a capability examiners had assumed was already present. Selection and copy now work across all five preview panes: the classic PST body, loose MSG and EML text, raw source, the modern OST body and raw transport headers.

The distinction that matters for court-bound work: you can select and copy the evidence, but you cannot alter it. Read-only is now enforced at the data layer rather than by locking the panel, so your clipboard works while the message itself stays unchanged.

v1.5.12 (2026-08-27)

  • The viewer can now be driven entirely from the keyboard, prompted by an examiner who works one-handed and could not move the message selection with a mouse alone. Every list now takes the keyboard: arrow keys, Home/End, Page Up/Down, Space to mark, Shift+arrows to extend. F6 moves between the folder tree, message list and body. Press / or Ctrl+F to jump into the filter and Esc to hand the keyboard back. The left-rail actions all have shortcuts, and the interface scales with Ctrl and the +, - or 0 keys. F1 and a KEYBOARD chip in the footer list every shortcut.
  • Carved message headers are shown in full. A carved message's header chain could be cut off partway through with no way to scroll to the rest, so a truncated chain looked the same as a genuinely short one. Header fields and body excerpts are now shown whole, and if a field is enormous the pane states how much is held back and points to Save raw bytes.
  • Your settings now persist. The interface theme and other preferences are kept across launches instead of resetting each time you open the viewer.

v1.5.10 (2026-08-27)

  • The filter box now searches inside the message, not just the envelope. A BODY toggle, on by default, matches your words anywhere in the message text, and a row found that way shows the matching passage in place of its date and path, badged BODY. HTML-only messages are searched as rendered text, not markup. It stays fast on large folders because the message bodies are already in memory.

v1.5.9 (2026-08-26)

  • Opening a folder of loose .msg files now lists every message. A folder of loose extracts that showed a count but no messages underneath is fixed, whether or not you filter first.
  • New RAW view in the preview (TEXT / RAW toggle): see a message's full internet headers, the Received chain hop by hop, Message-ID, Authentication-Results and Return-Path, with a Copy button. An .eml is shown byte for byte and marked SOURCE; a .msg is reassembled from its stored transport headers and body and marked ASSEMBLED, so a reconstruction never passes for the original. A message that never travelled over SMTP shows NOT AVAILABLE and why.
  • The preview panes now scroll in full. The forensic block, the transport chain, the raw headers and the attachment table below the message body are all reachable now, in the loose-message pane and the PST and modern-OST panes.
  • Reports can now include full internet headers after each message body, off by default. When a case turns on whether a message was sent, when or by whom, the Received chain proves transmission the way the body proves content. JSON reports carry the same field.
  • The first-run AI model download can no longer wedge the window. A stalled download times out and retries. Cancel stops it immediately and keeps the partial download to resume. Close works even while a download is running.

v1.5.8 (2026-08-23)

The largest update since 1.5.6, focused on exporting search hits as verifiable productions and searching every custodian in one pass:

  • Export search hits as an Outlook-mountable PST. Both Find in Archive and Cross-PST Search now carry a format toggle. .eml files stays the default that a review platform ingests, and one .pst writes a single Outlook-mountable container of the marked messages, one top-level folder per source archive, with a manifest.csv and a .sha256 of the container alongside. Attachments are written whole at any size, and each message hashes identically whether you export as .eml or as .pst, so the two productions are comparable row for row. Modern OST archives are included.
  • Cross-PST Search exports its results as a production set. Each hit is filed under one subfolder per source archive with a combined manifest.csv that tracks the source PST for every file, so identically-subjected mail from different custodians stays distinct. A custodian archive that will not open is recorded in the manifest rather than silently dropped, and Cancel leaves an accurate record of what was written.
  • Cross-PST Search can search message bodies, not just subject, sender and recipients. Scan bodies searches body text, headers and attachment filenames across every archive and tags each hit with its source, a match-type badge and a context snippet.
  • KEYWORDS, PHRASE and REGEX modes each search exactly as labeled, and an invalid regex reports itself instead of returning a misleading zero hits.
  • Clicking a Cross-PST Search result jumps to the message and keeps the search window open, and marked rows show a clear selection state so the set you export is the set you see. Open folder reveals an exported file selected rather than handing a .pst to Outlook, so opening a result never mounts your evidence.

v1.5.6 (2026-08-07)

Version 1.5.6. Folders of loose .msg and .eml files are now a first-class source. A message folder supports the full analysis set that previously required a PST or OST container: sensitive-data (YARA) scanning, attachment threat scanning, media inventory, timeline, communication map, report and export. Export can include only the messages you mark. You can filter a folder by year or by format then mark the whole filtered set at once. HTML-only messages now render as readable text instead of raw markup, with the message body shown above the metadata. Data Recovery and Find in Archive still require a PST or OST container and say so when selected.

v1.5.4 (2026-08-07)

Version 1.5.4. A performance and reliability release for very large message sets. Opening a folder of thousands of loose .msg files is now near-instant and uses a fraction of the memory it did, so the viewer stays responsive on exports that used to crawl. The Timeline and Communication Map now work on loose-message folders, not only on PST and OST containers. This release also fixes a selection issue where a message could shift under you while a scan finished.

v1.5.1 (2026-07-31)

  • A packaging release with no new features. The free download is 77% smaller, 36.9 MB instead of 160, because the speech model now downloads on first run for licensed users instead of shipping inside the installer.
  • New offline installers let an air-gapped machine be provisioned from one file. Upgrading from 1.5.0 keeps the model you already have and does not re-download it.

Windows installer EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: d0cab3ce8b24a48ab407d66c72ba6274de579a113e7d724bb8344cdbe457460c. Quick installer, 36.9 MB.

v1.5.0 (2026-07-31)

  • On-device AI (Windows and macOS). Transcribe voicemail and audio attachments and describe images and video frames while extracting the text inside them, all on your own machine.
  • Four threat scanners over the whole archive (malicious Office files, spoofing and authentication failures, tracking and active HTML content, PDF threats), with a sortable severity table and CSV export.
  • Deleted-item recovery on encrypted stores. Recovers over 50,000 deleted items from a real encrypted PST or OST archive where older carving found nothing, resumable mid-scan, exported as a hashed CSV.
  • Modern OST accuracy. Sender attribution, BCC recipients and real SMTP addresses now resolve correctly. An unreadable body is reported as unreadable rather than empty.
  • Jurisdiction sensitive-data scan, chained-segment custody log, rebuilt export and streaming large folders. Every table takes keyboard navigation and sorting.
  • Windows installer. Ships as a quick per-user installer with no admin prompt that bundles the Microsoft runtime; a full offline installer is available for air-gapped machines.
  • Windows installer EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: a2d01d6e3750e9903917d6228318729ca58d4bb4142de1858ee845ceb918f60c.

v1.4.0 (2026-07-04)

  • New: Free-tier gating. Free tier previews 50 messages per folder and 3 file opens per day (persisted across restarts, resets at midnight local time). Reopening a file you already opened today is free. The tool shows the true folder count with a preview chip and an "Unlock all messages" banner; it never silently hides content. Forensic Edition removes both limits.
  • New: Damaged-PST salvage. When a PST has a valid header but truncated or corrupt body, the viewer diagnoses the specific failure ("header says 9 GB, file is 5 GB, index missing") and reconstructs surviving messages from intact data pages. Free tier receives the diagnosis and upgrade prompt. Forensic Edition performs the reconstruction. Read-only on the evidence file. A real differentiator versus EnCase, Cellebrite and AXIOM which decline to process files that fail initial validation.

Recommendation: New users on 1.4.0 experience the gated free tier. Users already running 1.3.73 keep unlimited viewing on that build; upgrading to 1.4.0 activates the free tier limits and enables damaged-PST salvage. Forensic Edition license holders upgrade seamlessly with no license-key changes required.

Windows binary EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 840dc36454804372fa5fc446f21975ca8f2c99585dbdf6524dbad5da39f8adbc. TSA countersignature present, chains to 2034.

v1.3.71 (2026-06-12)

  • A PST that is open in Outlook or locked by another process is no longer reported as an unsupported file. The viewer now explains that the file is in use and how to open it. Close Outlook or copy the file and open the copy.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: bac15d5abd58feed33bbae342e3046b46e7bfc0c824c2be17444a381d0f0f83d. TSA countersignature present, chains to 2034. Commit 84a4f26.

v1.3.7 (2026-06-10)

  • Archive-wide search is fast again on mailboxes with Microsoft 365 and Exchange compressed-RTF bodies. The text renderer no longer runs on every message during search.
  • The body decoder is hardened against malformed size fields.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.7 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 0d92715dc9b35b2bdc5fb923a5a25e83b93a75699d3f42920ce44e8716811104. TSA countersignature present, chains to 2034.

v1.3.6 (2026-06-10)

  • Fixes blank message bodies on Microsoft 365 and Exchange compressed-RTF mail. The decoder was misreading the compression flag bit polarity.
  • The forensic detail panel in the .msg and .eml view is now collapsed by default so the message body has room.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.6 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 0abb510c1710a5e3c471a6925df805eab1271a846f666e410b2c86877479cbd4. TSA countersignature present, chains to 2034.

Special Thanks

Special thanks to Greg Smith of Dundee Corporation. Greg isolated that the affected message bodies rendered correctly in Outlook but not in Sherlock. He cross-checked the hit counts against an Outlook search to confirm the discrepancy. Critically, he provided a forensically intact sample that preserved the original Microsoft Exchange compressed-RTF (PR_RTF_COMPRESSED / LZFu) data. That sample let us pinpoint and correct a flag-decoding error in our RTF decompressor. We are grateful for his diligence and patience.

v1.3.5 (2026-06-10)

  • Fixes blank message bodies on Microsoft 365 and Exchange eDiscovery exports where the body is stored as compressed RTF. The viewer now decodes these resiliently and displays the content.
  • Report-export no longer crashes on unusual body data.
  • A privacy-safe diagnostic helps support troubleshoot display issues.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.5 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 35daade76361a0b09a4f2c3accaa0b7eae71bc31b3c16847f09a520de85cc208. TSA countersignature present, chains to 2034.

v1.3.4 (2026-06-09)

  • Opt-in raw message body in the diagnostic panel. The privacy-safe diagnostic cog now offers an optional checkbox that includes the raw message body bytes when sending diagnostic info to support. The label tells you exactly what gets shared (just that one message's body, no attachments) before you opt in. Gives the customer-support decoder-fix loop a consent-based path to share the failing bytes that 1.3.3's blank-body fallback cannot yet decode. Support can then decode your exact bytes and ship a true fix in a follow-up.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.4 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 6c03860a82fe3e84c68008d04d9b8c59e53e4e36c0fe8ee79c28fb7fcd24505b. TSA countersignature present, chains to 2034.

v1.3.3 (2026-06-09)

  • Fixes blank message bodies on Microsoft 365 / Exchange (eDiscovery) exports where the body is stored as compressed RTF.
  • Sender now shows the real SMTP address instead of the raw Exchange X.500 name. Subject lines no longer show stray leading glyphs.
  • Fixes a crash when exporting reports for messages with corrupt or unusual body data. Such bodies now display blank rather than garbled.
  • Adds a one-click, privacy-safe diagnostic (shares no email content) to help support troubleshoot display issues.

Recommendation: Forensic Edition users on 1.3.0 or any 1.3.2 build should update via the PRO badge in-app or re-download from the storefront. v1.3.3 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 90784ae3cb5590b43aa797ddc68d56f4edc293bd06d212daf7af4e6f37f04710. TSA countersignature present, chains to 2034.

v1.3.1 (2026-06-08). Bug-fix release for Exchange and OST handling

  • Compressed RTF body decompression. Exchange and OST messages previously previewed and exported with an empty body when the body content was stored in Microsoft's compressed RTF format. v1.3.1 decompresses the RTF and renders the actual body content in preview, search and every export format (PDF, JSONL, EML, MSG).
  • SMTP sender address resolution. The sender field previously displayed the raw Exchange X.500 address (/O=Org/OU=Group/CN=User) instead of the human-readable SMTP address. v1.3.1 resolves the X.500 name to the underlying SMTP address so reports and exports show [email protected] instead of the internal directory path.
  • Subject line glyph scrub. Subject lines previously showed stray leading control glyphs in some messages. v1.3.1 strips these before display, search indexing and export.

Recommendation: Forensic Edition users on v1.3.0 should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.1 is a drop-in replacement for v1.3.0 with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 5f53b9fab2bab20b5d975ef291fe5151c66cd513892f7765116f8421576d173f. TSA countersignature present, chains to 2034.

v1.2.7 (2026-05-27)

  • Minor fixes for PST 2003 file parsing
  • Adds 1 MB header upload on failure-to-load for diagnostic submission

v1.2.0 (2026-05-23)

  • Native modern Outlook OST support (4 KB-page PFF-variant, Outlook 2013+, Microsoft 365, cached-Exchange)
  • Find in Archive: whole-PST/OST keyword search across subject, body, from, to and attachment filenames
  • Export Documents: one-click extraction of all attached PDFs, Word, Excel, PowerPoint and other files with SHA-256 manifest
  • Whole-archive and per-folder PDF report generation with streaming generator (no OOM on multi-GB archives)
  • Findings catalog: unified sidebar showing all search results, pattern-scan matches and recovered items
  • Data Recovery as dedicated sidebar item with quality filter and inline detail panels
  • Sens-Data Scan improvements: scrollable results, CSV export, click-to-jump to matched message
  • Modern OST diagnostics with authoritative counts from NBT index
  • Crash diagnostics with structured logs and one-click submission to Sherlock
  • System-folder hiding for empty Outlook-internal folders (MS-OLK-*, Sync Issues, etc.)
  • Bulk attachment extraction with scope picker (current folder vs whole archive) and type filter
  • Per-message crash isolation so one corrupt block cannot kill an entire scan

v1.1.0 (2026-05-13)

  • Multi-monitor support with detachable analysis windows
  • Activity timeline with anomaly detection for send/delete volume spikes
  • Communication map as force-directed graph with per-edge message filtering
  • Cross-PST search across multiple custodian archives
  • Pattern-based sensitive-data scanning with format validators (Luhn for credit cards)
  • Deleted-item recovery using four independent carving methods
  • MAPI property explorer for raw property inspection
  • Attachment safe view with sandboxed rendering
  • Verifiable export container with Ed25519 signatures
  • Mark persistence across sessions with range-mark, show-marked-only and folder badges
  • In-message Ctrl+F search with digit-aware matching

v0.1.6 (2026-04-18)

  • MSG and EML file support (single file and folder batch mode)
  • MSG encoding detection (Unicode/ANSI)
  • Recursive folder scanning

← Back to Sherlock Forensics PST Viewer