Release History

Sherlock Forensics PST Viewer Changelog

Every release and its download verification (SHA-256), newest first. For the current download and product details see the Sherlock Forensics PST Viewer page.

v1.6.10 (2026-09-24) - Timezone fix and Arizona (MST)

Sherlock Forensics PST Viewer 1.6.10 fixes archive-search timestamps that displayed UTC instead of the selected timezone. It adds an Arizona (Phoenix) option under About > Display Timezone, correctly keeping Arizona on MST (UTC-7) year-round because Arizona does not observe daylight saving. Search timestamps now include seconds and the timezone abbreviation, so the customer example now displays 2023-03-15 16:24:55 MST. Original evidence timestamps remain unchanged.

v1.6.9 (2026-09-23) - Marked collection and export

Sherlock Forensics PST Viewer 1.6.9 adds MARKED to the sidebar with an archive-wide count and a review window, so emails marked across folders and searches accumulate in one collection. Export all marked writes a single Outlook PST or individual EML files, including attachments; view filters do not reduce the export scope, and exporting keeps the marks. Export is blocked if marked messages cannot be located, which prevents silent omissions. Mark persistence is improved: marks survive restarts and source-file moves; selections made during initial hashing are preserved; save or load errors are shown. This release also fixes attachment previews, Save and Save All choosing Windows 8.3 aliases such as SENTEN~1.pdf when the original long filename exists in the PST.

1.6.9 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 c9de495d1ff28c71246468d3baf0885cd3974009a78a937e9d052ef3be8cf8c9. Standard AI f1c12cdce3dc74e9d90922c14a777f0d7c286db4e32fc9459cf27f88f431bc1d. High-accuracy AI 5ee9aecb9602db7116e140152a4494f760229d54e9c9376c38fde9e8c46c92c3. macOS 03f560e0a5dab38cafae57aa43eaa9511b8457c27d1988ceb3b6185b14f67575. Linux 34a90b7321ff7ed9e1a475405b84ea53fe32a18e99834a688a7270b740bd0d0f.

v1.6.8 (2026-09-23) - Advanced query mode

Sherlock Forensics PST Viewer 1.6.8 adds an Advanced query mode to Find in Archive and X-PST Search, with Lucene-style syntax. Build precise queries with Boolean AND, OR, NOT, parentheses and field groups; field filters for subject:, from:, to:, cc:, body:, folder: and attachment:; quoted phrases, * and ? wildcards and has:attachment; and inclusive received-date ranges such as date:[2025-01-01 TO 2025-12-31], interpreted in UTC. Syntax errors are reported clearly, and a QUERY badge shows the complete expression in the results. Example: from:alice AND (subject:invoice OR subject:payment) NOT subject:draft. Advanced query mode reuses the existing index and search workers, and ordinary keyword search is unchanged. Cross-PST quick search uses indexed metadata, while full-message search covers bodies, email addresses and attachment filters. This is Lucene-style advanced search, not a full Apache Lucene implementation. Attachment filters match filenames, not attachment contents, and advanced queries exclude stored audio transcripts.

1.6.8 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 117d9ca1d6729a1def3203e901ab0e2e71c86866b06f7ef4381a10738cc60cbf. Standard AI 4c4531e9965f83123bc7b893a3929d1a5f1a2521275fdb06df7166e1f51dea69. High-accuracy AI a5c39e80726eb882bc05cd601acef48849961fa9f2454147b57f6477c8a2c049. macOS f64ca1428a8fe4404a68130a994708e4b6080afdefb81f8721778625ebf9f165. Linux 2fa9e9effd638e0b95b729e03f8574db95cf65a527a762cc1839491cf98879c0.

v1.6.7 (2026-09-23)

Sherlock Forensics PST Viewer 1.6.7 adds an Outlook-style calendar with day, week and month views, meeting details, response badges, overlapping meetings and all-day events. ICS invitations from messages appear muted with dotted outlines until matching acceptance is recorded. Calendar loading now shows progress, and users can jump directly to a year. Message headers always display SENT BY when recorded, with the earliest retained relay shown separately. This release also includes media-gallery improvements and fixes exported PSTs appearing as "Empty" in Outlook. Calendar limitations: UTC display; recurring series show their first stored occurrence. Unsupported or ambiguous invitation timezones remain undated.

1.6.7 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 16738567107d9d618d95ed8a6c547bb662c8403357161ae8ce018c09ee966eb7. Standard AI 943da620d800bb1ba36967218164b064b064a8b40742ec343a6516fb9ee57b1e. High-accuracy AI 3375119d29ba46b243fea779dc714c0aec433e25b45013844c226339a7a7d7b1. macOS e658361bdc0576e3d88ebb944e694dbb41ead5859a66ee84536f68bfde1df96f. Linux 9043e5920887bbab93b7cb287ec22817715868c9a5942fa51900fe62382e5a7e.

v1.6.5 (2026-09-19)

  • Attachment totals. Count attachments and their total size across a PST, with faster metadata counting, optional exact payload measurement, partial totals kept when cancelled and resume within the same session.
  • Cleaned PST exports. Produce one cleaned PST per source or combine multiple sources into one while retaining separate source folders. Apply attachment-type and threat-severity rules, with removal placeholders, CSV ledgers and export reports.
  • Source protection. Originals are opened read-only. Cleaning creates new files, refuses overwrites and verifies outputs before marking them complete.
  • Deeper threat inspection. 7-Zip and zstd support, nested archive inspection, decompression limits and explicit warnings about unexamined content. Script attachments are inspected for suspicious content without execution.
  • Offline activation. Activate air-gapped workstations using machine-bound request and response files, with clearer licensing and network errors.
  • Improved interface. Redesigned Archive Summary, Cleaned PST Copies, Scan Threats, search and review screens, with clearer progress and results.
  • Cross-platform fixes. Chinese, Japanese and Korean font support on macOS and Linux, corrected Linux dependencies and enforced glibc 2.35 compatibility.

Cleaning produces derivative archives; static checks do not certify retained attachments as safe.

1.6.5 installers EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). Quick SHA-256 40b295efc9fc56c34ca776eaadb7b796f878920d4c6e6101bfed2518af27c6fc. Standard AI acb3c722217cb42578ea2e177cec6dd1e0e1d7e854a47dfee1a81077368c7cd5. High-accuracy AI c15adb92038d4fa8390317753e4d8dad525f849aa99ba6f95c74264d4f758c2a. macOS 2e04f71aa3c1d69f8871822785523c95b55b939a88eb2a4fa145d009ff575ec2. Linux 6563c356bce7728daf3aa1b3e5d114e080ae37af48a69325a579e08e0fc4861b.

v1.6.2 (2026-09-05)

  • Reads Outlook for Mac (OLM) archives on Windows, macOS and Linux. Messages, folder tree, attachments, search, export and reports, including salvage of a damaged OLM archive whose index is gone.
  • Linux, the first ever release. A Debian package for Ubuntu 22.04 or newer, Debian 12 or newer and Kali on 64-bit Intel or AMD. The on-device AI features are Windows and macOS only.
  • On-device AI on macOS. The engine now downloads with the models in the same consent dialog.
  • Automatic activation. The app collects your license at startup, so there is no key to paste by hand.
  • Security: the updater verifies its download. It now refuses anything not signed by Sherlock Forensics Ltd before it swaps the binary.
  • Two interface fixes: the Forensic Edition preview no longer opens behind the main window, and its Activate and Buy buttons are no longer clipped without a scrollbar.

The last installer most customers could actually download was 1.5.12, so this is a bigger jump than the number suggests.

v1.5.13 (2026-08-31)

Select and copy text straight from any message preview. Highlight a passage with the mouse or by keyboard (Shift with the arrow keys, Ctrl+A to select all, Ctrl+C to copy), then paste it directly into your report. A new Copy message text button sits next to Copy raw source, and every step is documented under F1.

This restores a capability examiners had assumed was already present. Selection and copy now work across all five preview panes: the classic PST body, loose MSG and EML text, raw source, the modern OST body and raw transport headers.

The distinction that matters for court-bound work: you can select and copy the evidence, but you cannot alter it. Read-only is now enforced at the data layer rather than by locking the panel, so your clipboard works while the message itself stays unchanged.

v1.5.12 (2026-08-27)

  • The viewer can now be driven entirely from the keyboard, prompted by an examiner who works one-handed and could not move the message selection with a mouse alone. Every list now takes the keyboard: arrow keys, Home/End, Page Up/Down, Space to mark, Shift+arrows to extend. F6 moves between the folder tree, message list and body. Press / or Ctrl+F to jump into the filter and Esc to hand the keyboard back. The left-rail actions all have shortcuts, and the interface scales with Ctrl and the +, - or 0 keys. F1 and a KEYBOARD chip in the footer list every shortcut.
  • Carved message headers are shown in full. A carved message's header chain could be cut off partway through with no way to scroll to the rest, so a truncated chain looked the same as a genuinely short one. Header fields and body excerpts are now shown whole, and if a field is enormous the pane states how much is held back and points to Save raw bytes.
  • Your settings now persist. The interface theme and other preferences are kept across launches instead of resetting each time you open the viewer.

v1.5.10 (2026-08-27)

  • The filter box now searches inside the message, not just the envelope. A BODY toggle, on by default, matches your words anywhere in the message text, and a row found that way shows the matching passage in place of its date and path, badged BODY. HTML-only messages are searched as rendered text, not markup. It stays fast on large folders because the message bodies are already in memory.

v1.5.9 (2026-08-26)

  • Opening a folder of loose .msg files now lists every message. A folder of loose extracts that showed a count but no messages underneath is fixed, whether or not you filter first.
  • New RAW view in the preview (TEXT / RAW toggle): see a message's full internet headers, the Received chain hop by hop, Message-ID, Authentication-Results and Return-Path, with a Copy button. An .eml is shown byte for byte and marked SOURCE; a .msg is reassembled from its stored transport headers and body and marked ASSEMBLED, so a reconstruction never passes for the original. A message that never travelled over SMTP shows NOT AVAILABLE and why.
  • The preview panes now scroll in full. The forensic block, the transport chain, the raw headers and the attachment table below the message body are all reachable now, in the loose-message pane and the PST and modern-OST panes.
  • Reports can now include full internet headers after each message body, off by default. When a case turns on whether a message was sent, when or by whom, the Received chain proves transmission the way the body proves content. JSON reports carry the same field.
  • The first-run AI model download can no longer wedge the window. A stalled download times out and retries. Cancel stops it immediately and keeps the partial download to resume. Close works even while a download is running.

v1.5.8 (2026-08-23)

The largest update since 1.5.6, focused on exporting search hits as verifiable productions and searching every custodian in one pass:

  • Export search hits as an Outlook-mountable PST. Both Find in Archive and Cross-PST Search now carry a format toggle. .eml files stays the default that a review platform ingests, and one .pst writes a single Outlook-mountable container of the marked messages, one top-level folder per source archive, with a manifest.csv and a .sha256 of the container alongside. Attachments are written whole at any size, and each message hashes identically whether you export as .eml or as .pst, so the two productions are comparable row for row. Modern OST archives are included.
  • Cross-PST Search exports its results as a production set. Each hit is filed under one subfolder per source archive with a combined manifest.csv that tracks the source PST for every file, so identically-subjected mail from different custodians stays distinct. A custodian archive that will not open is recorded in the manifest rather than silently dropped, and Cancel leaves an accurate record of what was written.
  • Cross-PST Search can search message bodies, not just subject, sender and recipients. Scan bodies searches body text, headers and attachment filenames across every archive and tags each hit with its source, a match-type badge and a context snippet.
  • KEYWORDS, PHRASE and REGEX modes each search exactly as labeled, and an invalid regex reports itself instead of returning a misleading zero hits.
  • Clicking a Cross-PST Search result jumps to the message and keeps the search window open, and marked rows show a clear selection state so the set you export is the set you see. Open folder reveals an exported file selected rather than handing a .pst to Outlook, so opening a result never mounts your evidence.

v1.5.6 (2026-08-07)

Version 1.5.6. Folders of loose .msg and .eml files are now a first-class source. A message folder supports the full analysis set that previously required a PST or OST container: sensitive-data (YARA) scanning, attachment threat scanning, media inventory, timeline, communication map, report and export. Export can include only the messages you mark. You can filter a folder by year or by format then mark the whole filtered set at once. HTML-only messages now render as readable text instead of raw markup, with the message body shown above the metadata. Data Recovery and Find in Archive still require a PST or OST container and say so when selected.

v1.5.4 (2026-08-07)

Version 1.5.4. A performance and reliability release for very large message sets. Opening a folder of thousands of loose .msg files is now near-instant and uses a fraction of the memory it did, so the viewer stays responsive on exports that used to crawl. The Timeline and Communication Map now work on loose-message folders, not only on PST and OST containers. This release also fixes a selection issue where a message could shift under you while a scan finished.

v1.5.1 (2026-07-31)

  • A packaging release with no new features. The free download is 77% smaller, 36.9 MB instead of 160, because the speech model now downloads on first run for licensed users instead of shipping inside the installer.
  • New offline installers let an air-gapped machine be provisioned from one file. Upgrading from 1.5.0 keeps the model you already have and does not re-download it.

Windows installer EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: d0cab3ce8b24a48ab407d66c72ba6274de579a113e7d724bb8344cdbe457460c. Quick installer, 36.9 MB.

v1.5.0 (2026-07-31)

  • On-device AI (Windows and macOS). Transcribe voicemail and audio attachments and describe images and video frames while extracting the text inside them, all on your own machine.
  • Four threat scanners over the whole archive (malicious Office files, spoofing and authentication failures, tracking and active HTML content, PDF threats), with a sortable severity table and CSV export.
  • Deleted-item recovery on encrypted stores. Recovers over 50,000 deleted items from a real encrypted PST or OST archive where older carving found nothing, resumable mid-scan, exported as a hashed CSV.
  • Modern OST accuracy. Sender attribution, BCC recipients and real SMTP addresses now resolve correctly. An unreadable body is reported as unreadable rather than empty.
  • Jurisdiction sensitive-data scan, chained-segment custody log, rebuilt export and streaming large folders. Every table takes keyboard navigation and sorting.
  • Windows installer. Ships as a quick per-user installer with no admin prompt that bundles the Microsoft runtime; a full offline installer is available for air-gapped machines.
  • Windows installer EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: a2d01d6e3750e9903917d6228318729ca58d4bb4142de1858ee845ceb918f60c.

v1.4.0 (2026-07-04)

  • New: Free-tier gating. Free tier previews 50 messages per folder and 3 file opens per day (persisted across restarts, resets at midnight local time). Reopening a file you already opened today is free. The tool shows the true folder count with a preview chip and an "Unlock all messages" banner; it never silently hides content. Forensic Edition removes both limits.
  • New: Damaged-PST salvage. When a PST has a valid header but truncated or corrupt body, the viewer diagnoses the specific failure ("header says 9 GB, file is 5 GB, index missing") and reconstructs surviving messages from intact data pages. Free tier receives the diagnosis and upgrade prompt. Forensic Edition performs the reconstruction. Read-only on the evidence file. A real differentiator versus EnCase, Cellebrite and AXIOM which decline to process files that fail initial validation.

Recommendation: New users on 1.4.0 experience the gated free tier. Users already running 1.3.73 keep unlimited viewing on that build; upgrading to 1.4.0 activates the free tier limits and enables damaged-PST salvage. Forensic Edition license holders upgrade seamlessly with no license-key changes required.

Windows binary EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 840dc36454804372fa5fc446f21975ca8f2c99585dbdf6524dbad5da39f8adbc. TSA countersignature present, chains to 2034.

v1.3.71 (2026-06-12)

  • A PST that is open in Outlook or locked by another process is no longer reported as an unsupported file. The viewer now explains that the file is in use and how to open it. Close Outlook or copy the file and open the copy.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: bac15d5abd58feed33bbae342e3046b46e7bfc0c824c2be17444a381d0f0f83d. TSA countersignature present, chains to 2034. Commit 84a4f26.

v1.3.7 (2026-06-10)

  • Archive-wide search is fast again on mailboxes with Microsoft 365 and Exchange compressed-RTF bodies. The text renderer no longer runs on every message during search.
  • The body decoder is hardened against malformed size fields.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.7 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 0d92715dc9b35b2bdc5fb923a5a25e83b93a75699d3f42920ce44e8716811104. TSA countersignature present, chains to 2034.

v1.3.6 (2026-06-10)

  • Fixes blank message bodies on Microsoft 365 and Exchange compressed-RTF mail. The decoder was misreading the compression flag bit polarity.
  • The forensic detail panel in the .msg and .eml view is now collapsed by default so the message body has room.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.6 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 0abb510c1710a5e3c471a6925df805eab1271a846f666e410b2c86877479cbd4. TSA countersignature present, chains to 2034.

Special Thanks

Special thanks to Greg Smith of Dundee Corporation. Greg isolated that the affected message bodies rendered correctly in Outlook but not in Sherlock. He cross-checked the hit counts against an Outlook search to confirm the discrepancy. Critically, he provided a forensically intact sample that preserved the original Microsoft Exchange compressed-RTF (PR_RTF_COMPRESSED / LZFu) data. That sample let us pinpoint and correct a flag-decoding error in our RTF decompressor. We are grateful for his diligence and patience.

v1.3.5 (2026-06-10)

  • Fixes blank message bodies on Microsoft 365 and Exchange eDiscovery exports where the body is stored as compressed RTF. The viewer now decodes these resiliently and displays the content.
  • Report-export no longer crashes on unusual body data.
  • A privacy-safe diagnostic helps support troubleshoot display issues.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.5 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 35daade76361a0b09a4f2c3accaa0b7eae71bc31b3c16847f09a520de85cc208. TSA countersignature present, chains to 2034.

v1.3.4 (2026-06-09)

  • Opt-in raw message body in the diagnostic panel. The privacy-safe diagnostic cog now offers an optional checkbox that includes the raw message body bytes when sending diagnostic info to support. The label tells you exactly what gets shared (just that one message's body, no attachments) before you opt in. Gives the customer-support decoder-fix loop a consent-based path to share the failing bytes that 1.3.3's blank-body fallback cannot yet decode. Support can then decode your exact bytes and ship a true fix in a follow-up.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.4 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 6c03860a82fe3e84c68008d04d9b8c59e53e4e36c0fe8ee79c28fb7fcd24505b. TSA countersignature present, chains to 2034.

v1.3.3 (2026-06-09)

  • Fixes blank message bodies on Microsoft 365 / Exchange (eDiscovery) exports where the body is stored as compressed RTF.
  • Sender now shows the real SMTP address instead of the raw Exchange X.500 name. Subject lines no longer show stray leading glyphs.
  • Fixes a crash when exporting reports for messages with corrupt or unusual body data. Such bodies now display blank rather than garbled.
  • Adds a one-click, privacy-safe diagnostic (shares no email content) to help support troubleshoot display issues.

Recommendation: Forensic Edition users on 1.3.0 or any 1.3.2 build should update via the PRO badge in-app or re-download from the storefront. v1.3.3 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 90784ae3cb5590b43aa797ddc68d56f4edc293bd06d212daf7af4e6f37f04710. TSA countersignature present, chains to 2034.

v1.3.1 (2026-06-08). Bug-fix release for Exchange and OST handling

  • Compressed RTF body decompression. Exchange and OST messages previously previewed and exported with an empty body when the body content was stored in Microsoft's compressed RTF format. v1.3.1 decompresses the RTF and renders the actual body content in preview, search and every export format (PDF, JSONL, EML, MSG).
  • SMTP sender address resolution. The sender field previously displayed the raw Exchange X.500 address (/O=Org/OU=Group/CN=User) instead of the human-readable SMTP address. v1.3.1 resolves the X.500 name to the underlying SMTP address so reports and exports show [email protected] instead of the internal directory path.
  • Subject line glyph scrub. Subject lines previously showed stray leading control glyphs in some messages. v1.3.1 strips these before display, search indexing and export.

Recommendation: Forensic Edition users on v1.3.0 should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.1 is a drop-in replacement for v1.3.0 with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 5f53b9fab2bab20b5d975ef291fe5151c66cd513892f7765116f8421576d173f. TSA countersignature present, chains to 2034.

v1.2.7 (2026-05-27)

  • Minor fixes for PST 2003 file parsing
  • Adds 1 MB header upload on failure-to-load for diagnostic submission

v1.2.0 (2026-05-23)

  • Native modern Outlook OST support (4 KB-page PFF-variant, Outlook 2013+, Microsoft 365, cached-Exchange)
  • Find in Archive: whole-PST/OST keyword search across subject, body, from, to and attachment filenames
  • Export Documents: one-click extraction of all attached PDFs, Word, Excel, PowerPoint and other files with SHA-256 manifest
  • Whole-archive and per-folder PDF report generation with streaming generator (no OOM on multi-GB archives)
  • Findings catalog: unified sidebar showing all search results, pattern-scan matches and recovered items
  • Data Recovery as dedicated sidebar item with quality filter and inline detail panels
  • Sens-Data Scan improvements: scrollable results, CSV export, click-to-jump to matched message
  • Modern OST diagnostics with authoritative counts from NBT index
  • Crash diagnostics with structured logs and one-click submission to Sherlock
  • System-folder hiding for empty Outlook-internal folders (MS-OLK-*, Sync Issues, etc.)
  • Bulk attachment extraction with scope picker (current folder vs whole archive) and type filter
  • Per-message crash isolation so one corrupt block cannot kill an entire scan

v1.1.0 (2026-05-13)

  • Multi-monitor support with detachable analysis windows
  • Activity timeline with anomaly detection for send/delete volume spikes
  • Communication map as force-directed graph with per-edge message filtering
  • Cross-PST search across multiple custodian archives
  • Pattern-based sensitive-data scanning with format validators (Luhn for credit cards)
  • Deleted-item recovery using four independent carving methods
  • MAPI property explorer for raw property inspection
  • Attachment safe view with sandboxed rendering
  • Verifiable export container with Ed25519 signatures
  • Mark persistence across sessions with range-mark, show-marked-only and folder badges
  • In-message Ctrl+F search with digit-aware matching

v0.1.6 (2026-04-18)

  • MSG and EML file support (single file and folder batch mode)
  • MSG encoding detection (Unicode/ANSI)
  • Recursive folder scanning

← Back to Sherlock Forensics PST Viewer