Free Download · Version 1.5.13

Built in Rust

Open PST Files Without Outlook. Free.

Drop a PST or OST file and read your emails. Search, browse folders, view attachments. No Outlook, no Office 365, no subscription. Just your emails.

Runs entirely on your machine, including the AI. Nothing, not even the AI analysis, is sent to a cloud.

Also opens modern OST, MSG and EML files. See our dedicated OST Viewer page.

Sherlock Forensics PST Viewer opens PST, OST (including modern Outlook 2013+ OST), MSG and EML email files on Windows without Outlook. Browse folders, search messages, view attachments and export emails. Starting with version 1.4.0, the free tier previews 50 messages per folder with 3 file opens per day; the Forensic Edition ($67) removes both limits. Version 1.4.0 also introduces damaged-PST salvage: the viewer diagnoses truncated and corrupt PSTs that Outlook cannot open and reconstructs surviving messages from the header and data pages.

Linux build temporarily unavailable, coming soon

You are reading your emails in seconds.

Linux requires: libgtk-3-0 libxcb1 libxcb-render0 libxcb-shape0 libxcb-xfixes0 libxkbcommon0 libwayland-client0 libfontconfig1 (apt-get install on Debian/Ubuntu, dnf install on RHEL/Fedora). See install instructions.

1.5.13 installs with a quick per-user installer that needs no admin prompt, so it suits locked-down examiner workstations. It bundles the Microsoft runtime it needs, so it runs on a clean machine with nothing preinstalled. Every engine is included. The AI models download on first run for licensed users. Decline them and you still have a complete, working viewer. Prefer everything in one file? A full offline version is available below.

Per-user install, no admin· No signup· SHA-256 verified· Since 2006
Sherlock Forensics PST Viewer main screen with Open File and Open Folder buttons and left rail navigation

Drop a PST file and start reading your emails

New to PST files? See our step-by-step guide to opening PST files. Or see how we compare to other PST viewers.

New in v1.5.6

Loose .msg and .eml folders are now first-class

Work directly from exported messages. Point the viewer at a folder of loose .msg or .eml files and run YARA sensitive-data scanning, attachment threat scanning, media inventory, timeline and communication map, with report and export of the messages you mark. Large folders stay responsive and hold in a fraction of the memory they once did. Data Recovery and Find in Archive still need a PST or OST container.

New in v1.5.0

On-device AI, deleted recovery on encrypted stores, four threat scanners

  • On-device AI. Transcribe voicemail and audio attachments into full-text-searchable text. Describe images and video frames while pulling out the text inside them, so a photographed document or a screenshot becomes searchable. It all runs on your own machine.
  • Four threat scanners. Four threat scanners run over the whole archive: malicious Office files, spoofing and authentication failures, tracking and active HTML content, PDF threats. Results are a sortable severity table you can filter and export.
  • Deleted-item recovery on encrypted stores. Most Outlook PST and OST files are encrypted by default, where older carving found nothing. 1.5.0 recovers over 50,000 deleted items from a real encrypted archive, resumable mid-scan, exported as a hashed CSV.
  • Modern OST accuracy. Sender attribution, BCC recipients and real SMTP addresses now resolve correctly where 1.4.0 dropped or mislabeled them. The tool now tells there is nothing here apart from this could not be read.
  • Sensitive-data scan by jurisdiction. Tabs by jurisdiction (Canada, the United States, Australia, the United Kingdom) and a common tab, with real checksum validation instead of pattern matching for far fewer false positives.
  • Chain of custody that survives a sealed log. A sealed log now continues in a cryptographically chained segment instead of refusing new entries, so returning to a case stays append-only and tamper-evident. Its signature is verifiable from the panel.
  • Export, rebuilt. One panel. Select multiple folders at once. Export individual messages as MSG and EML alongside whole-archive PST and MBOX.
  • Faster and smoother. Large folders stream in instead of freezing a 90,000-message inbox. Every table takes keyboard navigation and sorting. A fixed bug surfaced 2,516 attachments that had been hidden.

New in v1.4.0

Recovers Truncated and Corrupt PSTs That Outlook Cannot Open

Version 1.4.0 introduces damaged-PST salvage. When a PST has a valid header but a truncated body or a corrupt or missing internal index, Outlook refuses to open the file. Sherlock Forensics PST Viewer diagnoses the specific failure and reconstructs surviving messages from the intact data pages. The reconstruction runs read-only on the evidence file so the source is never modified.

What the Diagnostic Shows

The viewer inspects the PST header and reports the exact mismatch in plain language. Example: "Header declares 9 GB. File on disk is 5 GB. Internal index missing." The diagnosis surfaces before any reconstruction attempt so the examiner knows what condition the file is in.

How the Reconstruction Works

Sherlock walks the data pages that remain intact and rebuilds the folder tree and the message set from surviving MAPI records. Messages that carved successfully carry their original headers, metadata and attachments. Messages whose data pages were lost in the truncation are documented in the diagnostic report but cannot be reconstructed.

Why This Is a Real Differentiator

Sherlock accepts and reconstructs a PST that fails initial header and index validation, where EnCase, Cellebrite and AXIOM typically decline it. For investigators handling PST evidence with damaged sources this is the difference between "no evidence available" and "here is what survived."

Free tier: receives the diagnostic and a Forensic Edition upgrade prompt. Forensic Edition ($67): performs the full reconstruction and exports the recovered messages to PST, MSG, EML or court-ready PDF report.

New in v1.2.0

Native Modern OST Support

Sherlock Forensics PST Viewer opens modern Outlook OST files used by Outlook 2013 and newer, Microsoft 365 desktop and cached-Exchange profiles. This is the 4 KB-page PFF-variant format that standard PST parsers reject. Also adds whole-archive keyword search, one-click document export, per-folder PDF reports and a unified findings catalog.

Modern OST

Native Modern OST

Opens 4 KB-page PFF-variant OST files (wMagicClient=0x4F53, wVer=36) used by Outlook 2013+, Microsoft 365 and cached-Exchange profiles. Full folder tree, message list and body preview. Free to use.

Modern OST Diagnostics

Authoritative counts derived from the NBT index: total messages, expected attachments, contents-table rows, orphan list. Verify extraction completeness against ground truth.

Orphan Detection

NIDs present in the NBT but absent from any folder are still enumerated. zlib DEFLATE decompression for compressed blocks. System-folder hiding for empty Outlook-internal folders.

Search and Export

Find in Archive

Whole-PST/OST keyword search across subject, body, from, to and attachment filenames. Background worker with streaming results. Session history lets you replay past searches instantly. Markable hits feed into report scope.

Export Documents

One-click extraction of all attached PDFs, Word, Excel, PowerPoint, OpenDocument, RTF, TXT and CSV files. Flat directory output with manifest.csv and SHA-256 per file. Scope picker and type filter.

Expanded Reports

Whole-archive PDF report (single searchable PDF of every email), per-folder reports and marked-only reports. Streaming PDF generator prevents OOM on multi-GB archives. Works on both PST and modern OST.

Forensic Improvements

Findings Catalog

Unified sidebar showing every accumulated result: current and historic searches, pattern-scan matches and Data Recovery item counts. Click any row to jump back to that result set.

Data Recovery Sidebar

Dedicated sidebar item running all 4 carving methods. Quality filter hides low-signal fragments by default. Click any recovered item for inline detail with Save raw bytes and educational forensic notes.

Crash Diagnostics

Structured crash logs with panic message, file:line, backtrace and version. Auto-detected on startup with one-click submission to Sherlock. Per-message crash isolation in search and extract workers.

v1.1.0

Full Forensic Workstation

Sherlock Forensics PST Viewer transforms the viewer into a full forensic workstation with deleted-item recovery, pattern-based sensitive-data scanning, activity timelines, communication mapping, cross-archive search and multi-monitor support. Every new capability operates in read-only mode preserving evidence integrity.

Analysis Tools

Activity Timeline

Interactive histogram of all mailbox activity. Group by day, week, month or hour-of-day. Mouse-wheel zoom from full-archive down to single-day. Anomaly bars (volume > mean + 2 stddev) highlighted in yellow so off-hours bursts pop at a glance.

Communication Map

Force-directed graph of every sender/recipient relationship. PST owner pinned at center. Node sizes scale to message volume. Click any node for a sortable per-contact message list. Find collusion and unusual contact patterns at a glance.

Cross-PST Search

Load multiple custodians' archives into one search modal. Live substring matching across subjects, senders and recipients. Per-archive hit counts. Double-click any hit to jump straight into that PST, that folder, that message.

Sensitive Data Scanning

Pattern-scan every message body and attachment. Built-in rules for SSNs, credit cards (Luhn validated), AWS keys, Bitcoin (Base58Check), IBANs, phone numbers and IPv4. Format-validated to minimize false positives.

Pattern-based sensitive data scanning (SSN, credit card, AWS keys, IBAN)

pattern-based sensitive-data scanning

Sherlock Forensics PST Viewer cross-archive search across multiple PST files with per-archive hit counts

Cross-PST multi-custodian search

Forensic Recovery

Deleted-Item Recovery

Four independent carving methods scan unallocated PST space: regex scrape for RFC-822 headers, heap-on-node carving, compressed-RTF body recovery and B-tree zombie hunt. Per-method panic isolation. Confidence ratings on every recovered item.

MAPI Property Explorer

Every property the PST stores on a message in one filterable table. Hex IDs, named properties, raw value types. Read the Received hop chain, conversation index, message flags and internal Exchange properties.

Attachment Safe View

Preview attachments without opening them in the OS default handler. Type detection, hex header inspection, plain-text rendering of safe formats. Avoid drive-by exploits in adversarial archives.

Workflow

Multi-Monitor Analysis

Undock the Activity Timeline, Communication Map and Generate Report panes to their own OS-level windows. Drag to a second monitor, resize independently. The main app stays free for folder browsing.

Mark-and-Report

Marks persist across restarts (SHA-256 keyed). Shift+click range-mark. Show marked only filter. Per-folder badge counts. Report modal with per-row remove, PDF/CSV/JSON picker and auto-open on generation.

Verifiable Export

Every bulk export produces an Ed25519-signed manifest. Any third party can verify the export has not been altered using just a hash and a public key. No Sherlock install required to verify.

In-Message Search

Ctrl+F inside any message body. Every match highlights in place with next/previous navigation. Digit-aware mode: searching 1625941771559000 finds 1625 9417 7155 9000 with separators ignored.

Sherlock Forensics PST Viewer deleted email recovery showing recovered messages from unallocated PST space

Deleted email recovery with 4 carving methods

Sherlock Forensics PST Viewer email view with folder tree, message list, attachments and forensic buttons

Full email view with attachments and forensic tools

New in v0.1.6

MSG + EML Support

Sherlock Forensics PST Viewer reads individual Outlook .msg and RFC-822 .eml messages with the same forensic rigor as the PST path. Open a single file or point it at an entire folder for batch analysis with optional recursive scanning.

What Examiners Can Now Do

  • Single file analysis - drop a .msg or .eml on the viewer for full subject/from/to/body/attachments preview in under a second
  • Folder mode - point it at a folder of messages and every .msg and .eml becomes a browsable list with optional recursive scanning
  • Visual triage - sort, filter and check off messages that matter, then generate a court-ready PDF covering just those
  • Attachment extraction - one click per file or bulk "Save all" with per-attachment SHA-256 logging (Forensic Edition)

Forensic-Grade Analysis

Every MSG/EML opened gets an automatic forensic readout alongside the normal preview:

Message Class Translation

Meeting requests, delivery reports, S/MIME signed messages and internal Exchange messages translated into plain language.

MSG Encoding Detection

Unicode vs ANSI encoding surfaced clearly. Critical for non-Latin character evidence.

MAPI Timestamps Side-by-Side

Created, Modified, Submit and Delivery timestamps shown together so divergences jump out immediately.

SMTP Transport Chain

Every Received header parsed into a visual hop-by-hop trail. Single-line origin-to-destination summary answers "where did this message come from" at a glance.

Authentication Results

SPF, DKIM and DMARC verdicts with plain-English explanations. Instantly see if the sender domain's authentication passed or failed.

Anomaly Flags

Missing sender, auth failures, internal Exchange messages, unverifiable signatures, Message-ID/sender domain mismatches. All flagged automatically.

Chain of Custody

  • Every file opened gets its own SHA-256 computed locally (never uploaded)
  • Folder mode produces a manifest hash - SHA-256 over every file's path + hash, reproducible by any third party
  • Every operator action (open, view, mark, save attachment, generate report) is appended to the per-evidence chain-of-custody log

Compare

Free vs Pro

FeatureFreePro ($67)
Messages previewed per folder (v1.4.0+)50 (per folder)Unlimited
File opens per day (v1.4.0+)3 distinct files (resets at midnight)Unlimited
Damaged-PST salvage reconstruction (v1.4.0+)Diagnosis onlyFull reconstruction
Open PST/OST files (including modern Outlook OST)YesYes
Open MSG/EML filesYesYes
Folder mode (batch MSG/EML scan)YesYes
View emails, contacts, calendarYesYes
SHA256 hash verificationYesYes
SMTP transport chain visualizationYesYes
SPF/DKIM/DMARC authentication resultsYesYes
Modern OST diagnostics (NBT counts)YesYes
Anomaly detection flagsYesYes
MSG encoding detection (Unicode/ANSI)YesYes
Chain of custody loggingYesYes
Crash diagnostics + submissionYesYes
Individual attachment saveYesYes
Multi-monitor detachable windowsYesYes
In-message Ctrl+F search (digit-aware)YesYes
Mark persistence across restartsYesYes
Find in Archive (whole-archive keyword search)-Yes
Cross-PST/OST search-Yes
Communication map (force-directed graph)-Yes
Activity timeline with anomaly detection-Yes
Sensitive data scanning (pattern-based)-Yes
Export Documents (bulk attachment extraction)-Yes
Reports (whole-archive / per-folder / marked-only)-Yes
Data Recovery (4 carving methods)-Yes
Findings catalog-Yes
Deleted-item recovery-Yes
Attachment safe view-Yes
Verifiable export container (Ed25519)-Yes
Export to EML/MSG-Yes
Mbox export-Yes
Court-ready PDF reports-Yes
Per-message SHA-256 hashing-Yes
Sender IP attribution-Yes
Priority support-Yes

Forensic Reports

Court-Ready Forensic Reports

Sherlock Forensics PST Viewer Forensic Edition generates multi-page PDF forensic reports with SHA-256 hash verification per message, sender IP attribution from RFC-822 Received headers, SPF/DKIM/DMARC authentication results and chain of custody documentation. Reports are produced from read-only analysis with reproducible results.

Why Courts Accept Sherlock Reports

Every report produced by Sherlock Forensics PST Viewer Forensic Edition is built on six pillars of forensic integrity that courts require for digital evidence admission.

SHA-256 Per Message

Each email in the report carries its own SHA-256 hash. Verify individual messages independently without needing access to the full PST archive.

Sender IP Attribution

Originating IP address and hostname extracted from the RFC-822 Received header chain. Establishes where each message actually came from.

SPF/DKIM/DMARC Per Message

Authentication-Results headers parsed for each message. See whether the sender domain's email authentication passed or failed at delivery time.

Chain of Custody

Examiner ID, tool version, session ID, timestamp and source file SHA-256 documented. Every action from file open to report generation is logged.

Read-Only Analysis

The source file is never written to. Your original evidence remains byte-for-byte identical before and after examination.

Reproducible Results

Any qualified examiner can open the same PST file and produce identical hash values and attribution data. Results do not depend on the examiner or machine.

What the PDF Report Contains

Each generated report is a multi-page PDF structured for court submission.

  • Title page with case metadata including tool version, license holder, session ID, timestamp and source file SHA-256
  • Per-email evidence cards with sender attribution (name, email address, source IP and hostname from Received headers) and Authentication-Results
  • Recipient tables documenting To, Cc and Bcc fields with display names
  • Body content with HTML converted to readable text
  • SHA-256 hash computed individually for each message in the report

Mark Emails. Generate Report.

The workflow is straightforward. Browse or search the PST archive to locate relevant messages. Check the box next to each email you want included. Click Generate Report. Sherlock Forensics PST Viewer Forensic Edition produces the court-ready PDF with all forensic metadata included automatically. Marks are stored separately from the evidence file, preserving source integrity.

Deleted-email recovery

Recover Deleted Emails from PST Files

When emails get deleted in Outlook, they do not always vanish from the PST file. Outlook moves them to the Deleted Items folder (soft delete). When you empty Deleted Items, the items go to a Recoverable Items dumpster retained for 14 to 30 days depending on retention policy (hard delete). Even after that window, the binary record often remains in the PST file as deallocated B-tree pages, invisible to Outlook but recoverable by a forensic-grade parser.

Sherlock Forensics PST Viewer delivers forensic-grade deleted item recovery using four carving methods to recover deleted emails:

  1. Deleted Items folder enumeration. Surfaces soft-deleted messages still sitting in the user's Deleted Items folder.
  2. Recoverable Items dumpster scan. Surfaces hard-deleted messages in the 14 to 30 day retention dumpster, the same store Outlook's "Recover Deleted Items From Server" relies on.
  3. B-tree page scan. Surfaces messages whose folder reference was deleted but whose binary message body remains in deallocated PST node pages, including emails that have aged out of the Recoverable Items dumpster.
  4. Slack-space carving. Surfaces fragments of permanently purged emails in the file's slack space between allocated B-tree pages, recovering message body fragments after Outlook's auto-compact has run.

The result: you can recover deleted emails and undelete the messages Outlook claims are gone, including permanently deleted items that have aged past the Recoverable Items dumpster window. The four carving methods run in a single scan against the PST file with full chain-of-custody logging. This is the same deleted item recovery surface that the Forensic Edition exports to court-ready PDF reports below.

Recovery matrix

Soft Delete vs Hard Delete vs Permanently Purged: What Is Actually Recoverable

Delete TypeWhat Outlook ShowsWhat Is In the PSTRecoverable by Sherlock?
Soft delete (Delete key)Item in Deleted Items folderFull message body in Deleted ItemsYes - trivial enumeration
Hard delete (Shift+Delete)Item gone from Deleted ItemsFull message body in Recoverable Items dumpster, 14 to 30 day retentionYes - dumpster scan
Permanently deleted (past dumpster window)Item completely gone from Outlook UIFolder reference deleted, body may remain in deallocated B-tree pagesYes - B-tree page scan recovers most
Compacted PST (Outlook auto-compact)Item gone, file size reducedSlack space may contain fragmentsPartial - slack carving recovers fragments
Securely wiped PSTItem gone, file size reduced, sectors overwrittenNothing recoverableNo - secure erase prevents forensic recovery

The deleted item recovery in Sherlock Forensics PST Viewer covers rows 1 through 4 in the matrix above. Row 5 (secure wipe) is not recoverable by any forensic tool because the binary content has been overwritten at the storage layer. For deleted emails that fall in rows 1 through 4, the deleted item recovery happens in a single Sherlock scan with chain-of-custody output. The same deleted item recovery feature handles permanently deleted Outlook items, hard-deleted messages past the dumpster window and slack-space fragments after auto-compact.

Pricing

One-Time Payment. Yours Forever.

Single License

$67 USD
1 machine. One-time payment, lifetime license.
  • All free features included
  • Deleted-item recovery (4 carving methods)
  • pattern-based sensitive-data scanning
  • Attachment safe view (sandboxed)
  • Verifiable export container (Ed25519)
  • Byte-level attachment extraction (single + bulk)
  • Export to EML/MSG formats
  • Mbox export
  • Batch export entire PST archives
  • Court-ready PDF forensic reports
  • Chain of custody logging
  • Priority email support

Team License

$335 USD
5 machines. One-time payment, lifetime license. Ideal for small forensic teams.
  • All Single License features
  • Activate on up to 5 machines under one license key
  • One purchase covers the team. Same lifetime guarantee.
  • Priority email support

Need more than 5 seats? Contact us for larger team pricing.

Use Cases

Who Uses Sherlock Forensics PST Viewer

Legal and eDiscovery

Law firms and litigation support teams use Sherlock Forensics PST Viewer to review email archives during discovery. SHA256 hashing preserves evidentiary integrity. The Forensic Edition generates forensic reports suitable for court filing. Pairs with our expert witness services for testimony support.

IT Administrators

Recover and review emails from departed employees without reactivating Exchange or Microsoft 365 licenses. Search archived PST files for specific communications during internal audits. No Outlook installation required on review workstations.

Forensic Examiners

Purpose-built for forensic workflows. SHA256 hash verification on every message establishes chain of custody. Export individual messages or entire folders for inclusion in forensic investigation reports. Used alongside our full forensic tool suite.

HR and Compliance

Review archived employee email for policy violations, harassment investigations or regulatory compliance. Search across entire PST archives by keyword, date range or sender without involving IT. Chain of custody logging in Pro maintains investigation integrity.

Personal Use

Access old email backups without an active Outlook license. Search years of archived correspondence. View contacts and calendar entries stored in PST format. The free edition previews 50 messages per folder with 3 file opens per day. The Forensic Edition ($67) removes both limits.

Guide

How to Open a PST File Without Outlook

  1. Download Sherlock Forensics PST ViewerDownload the free installer from this page. 44.0 MB. SHA256 verified for integrity.
  2. Install and LaunchRun the installer on Windows 10 or 11. No admin privileges required. Launch from the Start menu.
  3. Open Your PST or OST FileClick Open File and browse to your .pst or .ost file. The viewer loads the folder structure and message list automatically.
  4. Search and BrowseUse the search bar to find emails by sender, subject or keyword. Browse Inbox, Sent Items, Contacts and Calendar folders.
  5. Verify and ExportView SHA256 hashes to confirm data integrity. Pro users can export to EML/MSG, generate forensic reports and log chain of custody.

Compare

Why Sherlock Forensics PST Viewer

Forensic Pedigree at a Fraction of the Cost

SysTools PST Viewer Forensic Edition costs $299 USD. Kernel PST Viewer charges $79 USD. Sherlock Forensics PST Viewer Forensic Edition is $67 USD with capabilities neither competitor offers: SHA256 hash verification per message, forensic report generation and chain of custody logging built by CISSP, ISSAP and ISSMP certified examiners with 20 years of courtroom experience.

Most PST viewers are built by software companies. Sherlock Forensics PST Viewer is built by forensic investigators who use it in active casework. The difference shows in the details: hash verification, evidence integrity and documentation that courts accept. Read our full 2026 PST viewer comparison or see our side-by-side PST viewer comparison table.

Changelog

Release History

v1.5.13 (2026-08-31)

Select and copy text straight from any message preview. Highlight a passage with the mouse or by keyboard (Shift with the arrow keys, Ctrl+A to select all, Ctrl+C to copy), then paste it directly into your report. A new Copy message text button sits next to Copy raw source, and every step is documented under F1.

This restores a capability examiners had assumed was already present. Selection and copy now work across all five preview panes: the classic PST body, loose MSG and EML text, raw source, the modern OST body and raw transport headers.

The distinction that matters for court-bound work: you can select and copy the evidence, but you cannot alter it. Read-only is now enforced at the data layer rather than by locking the panel, so your clipboard works while the message itself stays unchanged.

v1.5.12 (2026-08-27)

  • The viewer can now be driven entirely from the keyboard, prompted by an examiner who works one-handed and could not move the message selection with a mouse alone. Every list now takes the keyboard: arrow keys, Home/End, Page Up/Down, Space to mark, Shift+arrows to extend. F6 moves between the folder tree, message list and body. Press / or Ctrl+F to jump into the filter and Esc to hand the keyboard back. The left-rail actions all have shortcuts, and the interface scales with Ctrl and the +, - or 0 keys. F1 and a KEYBOARD chip in the footer list every shortcut.
  • Carved message headers are shown in full. A carved message's header chain could be cut off partway through with no way to scroll to the rest, so a truncated chain looked the same as a genuinely short one. Header fields and body excerpts are now shown whole, and if a field is enormous the pane states how much is held back and points to Save raw bytes.
  • Your settings now persist. The interface theme and other preferences are kept across launches instead of resetting each time you open the viewer.

v1.5.10 (2026-08-27)

  • The filter box now searches inside the message, not just the envelope. A BODY toggle, on by default, matches your words anywhere in the message text, and a row found that way shows the matching passage in place of its date and path, badged BODY. HTML-only messages are searched as rendered text, not markup. It stays fast on large folders because the message bodies are already in memory.

v1.5.9 (2026-08-26)

  • Opening a folder of loose .msg files now lists every message. A folder of loose extracts that showed a count but no messages underneath is fixed, whether or not you filter first.
  • New RAW view in the preview (TEXT / RAW toggle): see a message's full internet headers, the Received chain hop by hop, Message-ID, Authentication-Results and Return-Path, with a Copy button. An .eml is shown byte for byte and marked SOURCE; a .msg is reassembled from its stored transport headers and body and marked ASSEMBLED, so a reconstruction never passes for the original. A message that never travelled over SMTP shows NOT AVAILABLE and why.
  • The preview panes now scroll in full. The forensic block, the transport chain, the raw headers and the attachment table below the message body are all reachable now, in the loose-message pane and the PST and modern-OST panes.
  • Reports can now include full internet headers after each message body, off by default. When a case turns on whether a message was sent, when or by whom, the Received chain proves transmission the way the body proves content. JSON reports carry the same field.
  • The first-run AI model download can no longer wedge the window. A stalled download times out and retries. Cancel stops it immediately and keeps the partial download to resume. Close works even while a download is running.

v1.5.8 (2026-08-23)

The largest update since 1.5.6, focused on exporting search hits as verifiable productions and searching every custodian in one pass:

  • Export search hits as an Outlook-mountable PST. Both Find in Archive and Cross-PST Search now carry a format toggle. .eml files stays the default that a review platform ingests, and one .pst writes a single Outlook-mountable container of the marked messages, one top-level folder per source archive, with a manifest.csv and a .sha256 of the container alongside. Attachments are written whole at any size, and each message hashes identically whether you export as .eml or as .pst, so the two productions are comparable row for row. Modern OST archives are included.
  • Cross-PST Search exports its results as a production set. Each hit is filed under one subfolder per source archive with a combined manifest.csv that tracks the source PST for every file, so identically-subjected mail from different custodians stays distinct. A custodian archive that will not open is recorded in the manifest rather than silently dropped, and Cancel leaves an accurate record of what was written.
  • Cross-PST Search can search message bodies, not just subject, sender and recipients. Scan bodies searches body text, headers and attachment filenames across every archive and tags each hit with its source, a match-type badge and a context snippet.
  • KEYWORDS, PHRASE and REGEX modes each search exactly as labeled, and an invalid regex reports itself instead of returning a misleading zero hits.
  • Clicking a Cross-PST Search result jumps to the message and keeps the search window open, and marked rows show a clear selection state so the set you export is the set you see. Open folder reveals an exported file selected rather than handing a .pst to Outlook, so opening a result never mounts your evidence.

v1.5.6 (2026-08-07)

Version 1.5.6. Folders of loose .msg and .eml files are now a first-class source. A message folder supports the full analysis set that previously required a PST or OST container: sensitive-data (YARA) scanning, attachment threat scanning, media inventory, timeline, communication map, report and export. Export can include only the messages you mark. You can filter a folder by year or by format then mark the whole filtered set at once. HTML-only messages now render as readable text instead of raw markup, with the message body shown above the metadata. Data Recovery and Find in Archive still require a PST or OST container and say so when selected.

v1.5.4 (2026-08-07)

Version 1.5.4. A performance and reliability release for very large message sets. Opening a folder of thousands of loose .msg files is now near-instant and uses a fraction of the memory it did, so the viewer stays responsive on exports that used to crawl. The Timeline and Communication Map now work on loose-message folders, not only on PST and OST containers. This release also fixes a selection issue where a message could shift under you while a scan finished.

v1.5.1 (2026-07-31)

  • A packaging release with no new features. The free download is 77% smaller, 36.9 MB instead of 160, because the speech model now downloads on first run for licensed users instead of shipping inside the installer.
  • New offline installers let an air-gapped machine be provisioned from one file. Upgrading from 1.5.0 keeps the model you already have and does not re-download it.

Windows installer EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: d0cab3ce8b24a48ab407d66c72ba6274de579a113e7d724bb8344cdbe457460c. Quick installer, 36.9 MB.

v1.5.0 (2026-07-31)

  • On-device AI. Transcribe voicemail and audio attachments and describe images and video frames while extracting the text inside them, all on your own machine.
  • Four threat scanners over the whole archive (malicious Office files, spoofing and authentication failures, tracking and active HTML content, PDF threats), with a sortable severity table and CSV export.
  • Deleted-item recovery on encrypted stores. Recovers over 50,000 deleted items from a real encrypted PST or OST archive where older carving found nothing, resumable mid-scan, exported as a hashed CSV.
  • Modern OST accuracy. Sender attribution, BCC recipients and real SMTP addresses now resolve correctly. An unreadable body is reported as unreadable rather than empty.
  • Jurisdiction sensitive-data scan, chained-segment custody log, rebuilt export and streaming large folders. Every table takes keyboard navigation and sorting.
  • Windows installer. Ships as a quick per-user installer with no admin prompt that bundles the Microsoft runtime; a full offline installer is available for air-gapped machines.
  • Windows installer EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: a2d01d6e3750e9903917d6228318729ca58d4bb4142de1858ee845ceb918f60c.

v1.4.0 (2026-07-04)

  • New: Free-tier gating. Free tier previews 50 messages per folder and 3 file opens per day (persisted across restarts, resets at midnight local time). Reopening a file you already opened today is free. The tool shows the true folder count with a preview chip and an "Unlock all messages" banner; it never silently hides content. Forensic Edition removes both limits.
  • New: Damaged-PST salvage. When a PST has a valid header but truncated or corrupt body, the viewer diagnoses the specific failure ("header says 9 GB, file is 5 GB, index missing") and reconstructs surviving messages from intact data pages. Free tier receives the diagnosis and upgrade prompt. Forensic Edition performs the reconstruction. Read-only on the evidence file. A real differentiator versus EnCase, Cellebrite and AXIOM which decline to process files that fail initial validation.

Recommendation: New users on 1.4.0 experience the gated free tier. Users already running 1.3.73 keep unlimited viewing on that build; upgrading to 1.4.0 activates the free tier limits and enables damaged-PST salvage. Forensic Edition license holders upgrade seamlessly with no license-key changes required.

Windows binary EV code-signed (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 840dc36454804372fa5fc446f21975ca8f2c99585dbdf6524dbad5da39f8adbc. TSA countersignature present, chains to 2034. Linux binary (unsigned per convention, no Linux signing infrastructure required): built on Ubuntu with Rust 1.96.1, clean x86-64 PIE ELF, hash-matched transfer. SHA-256: 697958fb78366b2914277bb3126810b9476cec2eaff91b0d015c9db504c4f4a3. Both OSes ship the same source (pst-viewer@7cdb879) and the same gating and salvage behaviour.

v1.3.71 (2026-06-12)

  • A PST that is open in Outlook or locked by another process is no longer reported as an unsupported file. The viewer now explains that the file is in use and how to open it. Close Outlook or copy the file and open the copy.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: bac15d5abd58feed33bbae342e3046b46e7bfc0c824c2be17444a381d0f0f83d. TSA countersignature present, chains to 2034. Commit 84a4f26.

v1.3.7 (2026-06-10)

  • Archive-wide search is fast again on mailboxes with Microsoft 365 and Exchange compressed-RTF bodies. The text renderer no longer runs on every message during search.
  • The body decoder is hardened against malformed size fields.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.7 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 0d92715dc9b35b2bdc5fb923a5a25e83b93a75699d3f42920ce44e8716811104. TSA countersignature present, chains to 2034.

v1.3.6 (2026-06-10)

  • Fixes blank message bodies on Microsoft 365 and Exchange compressed-RTF mail. The decoder was misreading the compression flag bit polarity.
  • The forensic detail panel in the .msg and .eml view is now collapsed by default so the message body has room.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.6 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 0abb510c1710a5e3c471a6925df805eab1271a846f666e410b2c86877479cbd4. TSA countersignature present, chains to 2034.

Special Thanks

Special thanks to Greg Smith of Dundee Corporation. Greg isolated that the affected message bodies rendered correctly in Outlook but not in Sherlock. He cross-checked the hit counts against an Outlook search to confirm the discrepancy. Critically, he provided a forensically intact sample that preserved the original Microsoft Exchange compressed-RTF (PR_RTF_COMPRESSED / LZFu) data. That sample let us pinpoint and correct a flag-decoding error in our RTF decompressor. We are grateful for his diligence and patience.

v1.3.5 (2026-06-10)

  • Fixes blank message bodies on Microsoft 365 and Exchange eDiscovery exports where the body is stored as compressed RTF. The viewer now decodes these resiliently and displays the content.
  • Report-export no longer crashes on unusual body data.
  • A privacy-safe diagnostic helps support troubleshoot display issues.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.5 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 35daade76361a0b09a4f2c3accaa0b7eae71bc31b3c16847f09a520de85cc208. TSA countersignature present, chains to 2034.

v1.3.4 (2026-06-09)

  • Opt-in raw message body in the diagnostic panel. The privacy-safe diagnostic cog now offers an optional checkbox that includes the raw message body bytes when sending diagnostic info to support. The label tells you exactly what gets shared (just that one message's body, no attachments) before you opt in. Gives the customer-support decoder-fix loop a consent-based path to share the failing bytes that 1.3.3's blank-body fallback cannot yet decode. Support can then decode your exact bytes and ship a true fix in a follow-up.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.4 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 6c03860a82fe3e84c68008d04d9b8c59e53e4e36c0fe8ee79c28fb7fcd24505b. TSA countersignature present, chains to 2034.

v1.3.3 (2026-06-09)

  • Fixes blank message bodies on Microsoft 365 / Exchange (eDiscovery) exports where the body is stored as compressed RTF.
  • Sender now shows the real SMTP address instead of the raw Exchange X.500 name. Subject lines no longer show stray leading glyphs.
  • Fixes a crash when exporting reports for messages with corrupt or unusual body data. Such bodies now display blank rather than garbled.
  • Adds a one-click, privacy-safe diagnostic (shares no email content) to help support troubleshoot display issues.

Recommendation: Forensic Edition users on 1.3.0 or any 1.3.2 build should update via the PRO badge in-app or re-download from the storefront. v1.3.3 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 90784ae3cb5590b43aa797ddc68d56f4edc293bd06d212daf7af4e6f37f04710. TSA countersignature present, chains to 2034.

v1.3.1 (2026-06-08). Bug-fix release for Exchange and OST handling

  • Compressed RTF body decompression. Exchange and OST messages previously previewed and exported with an empty body when the body content was stored in Microsoft's compressed RTF format. v1.3.1 decompresses the RTF and renders the actual body content in preview, search and every export format (PDF, JSONL, EML, MSG).
  • SMTP sender address resolution. The sender field previously displayed the raw Exchange X.500 address (/O=Org/OU=Group/CN=User) instead of the human-readable SMTP address. v1.3.1 resolves the X.500 name to the underlying SMTP address so reports and exports show user@domain.com instead of the internal directory path.
  • Subject line glyph scrub. Subject lines previously showed stray leading control glyphs in some messages. v1.3.1 strips these before display, search indexing and export.

Recommendation: Forensic Edition users on v1.3.0 should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.1 is a drop-in replacement for v1.3.0 with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 5f53b9fab2bab20b5d975ef291fe5151c66cd513892f7765116f8421576d173f. TSA countersignature present, chains to 2034.

v1.2.7 (2026-05-27)

  • Minor fixes for PST 2003 file parsing
  • Adds 1 MB header upload on failure-to-load for diagnostic submission

v1.2.0 (2026-05-23)

  • Native modern Outlook OST support (4 KB-page PFF-variant, Outlook 2013+, Microsoft 365, cached-Exchange)
  • Find in Archive: whole-PST/OST keyword search across subject, body, from, to and attachment filenames
  • Export Documents: one-click extraction of all attached PDFs, Word, Excel, PowerPoint and other files with SHA-256 manifest
  • Whole-archive and per-folder PDF report generation with streaming generator (no OOM on multi-GB archives)
  • Findings catalog: unified sidebar showing all search results, pattern-scan matches and recovered items
  • Data Recovery as dedicated sidebar item with quality filter and inline detail panels
  • Sens-Data Scan improvements: scrollable results, CSV export, click-to-jump to matched message
  • Modern OST diagnostics with authoritative counts from NBT index
  • Crash diagnostics with structured logs and one-click submission to Sherlock
  • System-folder hiding for empty Outlook-internal folders (MS-OLK-*, Sync Issues, etc.)
  • Bulk attachment extraction with scope picker (current folder vs whole archive) and type filter
  • Per-message crash isolation so one corrupt block cannot kill an entire scan

v1.1.0 (2026-05-13)

  • Multi-monitor support with detachable analysis windows
  • Activity timeline with anomaly detection for send/delete volume spikes
  • Communication map as force-directed graph with per-edge message filtering
  • Cross-PST search across multiple custodian archives
  • Pattern-based sensitive-data scanning with format validators (Luhn for credit cards)
  • Deleted-item recovery using four independent carving methods
  • MAPI property explorer for raw property inspection
  • Attachment safe view with sandboxed rendering
  • Verifiable export container with Ed25519 signatures
  • Mark persistence across sessions with range-mark, show-marked-only and folder badges
  • In-message Ctrl+F search with digit-aware matching

v0.1.6 (2026-04-18)

  • MSG and EML file support (single file and folder batch mode)
  • MSG encoding detection (Unicode/ANSI)
  • Recursive folder scanning

Questions

PST Viewer FAQ

Is Sherlock Forensics PST Viewer really free?
Yes. The free edition opens PST and OST files, previews 50 messages per folder with 3 file opens per day, includes search and verifies SHA256 hashes. The Forensic Edition at $67 USD removes both limits and adds export, forensic reporting and chain of custody logging.
Do I need Microsoft Outlook to open a PST file?
No. Sherlock Forensics PST Viewer opens PST and OST files without Outlook installed. It reads the PST format directly using its own parser. No Microsoft Office license required.
What is the difference between PST and OST files?
PST (Personal Storage Table) files are offline copies of mailbox data that can be moved between machines. OST (Offline Storage Table) files are local cached copies tied to an Exchange or Microsoft 365 account. Sherlock Forensics PST Viewer opens both formats.
Can I use this for forensic investigations?
Yes. The tool computes SHA256 hashes for every message, which establishes data integrity for legal proceedings. The Forensic Edition adds forensic report generation and chain of custody logging suitable for court submission.
What operating systems are supported?
Windows 10 and Windows 11 (64-bit) and Linux x64. Linux builds require libgtk-3, libfontconfig1 and libxkbcommon. macOS is not currently supported.
How large of a PST file can it handle?
Sherlock Forensics PST Viewer handles PST files up to 50 GB. Files over 20 GB may take longer to index on initial load. Performance depends on available system memory.
Is the $67 price a subscription?
No. The $67 USD Pro license is a one-time payment. No subscriptions, no recurring charges. You own the license permanently with free updates included.
How do I verify the download is safe?
Every download displays a SHA256 hash on the download page. After downloading, compute the SHA256 of the file and compare it to the published hash. If the values match, the file has not been tampered with. Use our Sherlock Forensics Hash tool or any SHA256 calculator.
Can I export emails from a PST file?
The Forensic Edition ($67 USD) supports exporting individual emails or batch exports to EML and MSG formats. The free edition is view-only with search and hash verification.
Do you offer volume licensing?
Yes. For 5 or more machines, contact Sherlock Forensics at 888.883.4550 or info@sherlockforensics.com for volume pricing.
Are Sherlock Forensics PST Viewer reports admissible in court?
Sherlock Forensics PST Viewer Forensic Edition generates forensic PDF reports with SHA-256 hashing per message, sender IP attribution extracted from Received headers, chain of custody documentation and read-only analysis verification. The tool is built by CISSP, ISSAP, ISSMP certified examiners with 20 years of courtroom experience. Admissibility depends on jurisdiction and proper evidence handling, but the reports document everything courts typically require for digital evidence admission.
How does per-message SHA-256 hashing work?
Each email in the PST archive is individually hashed using SHA-256 when included in a forensic report. This creates a unique cryptographic fingerprint for every message. Any modification to a single email would produce a completely different hash value, allowing independent verification of each message without needing to re-examine the entire archive.
Can I use Sherlock Forensics PST Viewer reports in civil litigation?
Admissibility depends on your jurisdiction and how evidence was handled throughout the investigation. Sherlock Forensics PST Viewer Forensic Edition reports document SHA-256 per-message hashes, sender IP attribution from RFC-822 Received headers, SPF/DKIM/DMARC authentication results, chain of custody and examiner identification. These are the elements courts typically require when evaluating digital evidence in civil proceedings.
Will Sherlock find emails the user deleted?
Yes. Sherlock Forensics PST Viewer includes deleted-item recovery with four carving methods. It scans unallocated space in the PST file and recovers messages that were emptied from the Deleted Items folder. Recovered messages appear in a dedicated Recovered Items view with metadata intact where available.
Can I scan a PST for credit cards, SSNs and other sensitive data?
Yes. The pattern-based sensitive-data scanner detects credit card numbers, Social Security numbers, passport numbers and other PII patterns across every message in the archive. Each match is validated with format-specific checks such as Luhn for credit cards to reduce false positives.
Can I work on two monitors?
Yes. Sherlock Forensics PST Viewer supports multi-monitor workflows. You can detach the message detail panel, the activity timeline, the communication map or any analysis window and move it to a second monitor. This lets you keep the message list on one screen and evidence detail on another.
Will my marks survive a restart?
Yes. Marks are persisted to a sidecar file stored alongside your evidence. When you reopen the same PST file your previous marks are restored automatically. The sidecar file never modifies the original evidence.
How do I search inside a long email body?
Press Ctrl+F while viewing a message to open the in-message search bar. The search is digit-aware so queries like 1234 will match 1,234 and 1234.00 as well as the literal string. Matches are highlighted with next/previous navigation.
Can I search across multiple custodians' PSTs at once?
Yes. Cross-PST search lets you open multiple PST files and run a single query across all of them. Results are grouped by source file with hit counts per archive. This is useful for multi-custodian eDiscovery where you need to find a keyword across several mailboxes simultaneously.
Does Sherlock Forensics PST Viewer work on Linux?
Yes. Sherlock Forensics PST Viewer 1.4.0 ships as a native Linux x64 binary (built on Ubuntu with Rust 1.96.1, clean x86-64 PIE ELF). Download the .tar.gz archive, extract and run. Runtime dependencies: libgtk-3-0 libxcb1 libxcb-render0 libxcb-shape0 libxcb-xfixes0 libxkbcommon0 libwayland-client0 libfontconfig1 (install via apt-get on Debian/Ubuntu or dnf on RHEL/Fedora). The Linux daily-counter file lands at ~/.config/sherlock/pst-viewer-free-opens.txt via the XDG path. Same free-tier gating and damaged-PST salvage as the Windows build.
Can I recover deleted emails from a PST file?
Yes. Sherlock Forensics PST Viewer recovers deleted emails using four carving methods: Deleted Items folder enumeration, Recoverable Items dumpster scan, B-tree page scan for deallocated message bodies and slack-space carving for fragmented remains. The recovery works on soft-deleted, hard-deleted and permanently deleted items, including emails Outlook claims are gone.
How long are deleted emails recoverable from a PST file?
Deleted Items folder retains soft-deleted emails until manually purged (indefinite). The Recoverable Items dumpster retains hard-deleted emails for 14 to 30 days depending on retention policy. After the dumpster window expires, the B-tree page scan still recovers most messages from deallocated pages until Outlook auto-compact runs. Sherlock surfaces all four recovery layers in a single scan.
Can I recover permanently deleted emails from Outlook?
Yes in most cases. Even after the Recoverable Items dumpster expires, the binary message body often remains in the PST file's deallocated B-tree pages until Outlook auto-compact runs. Sherlock Forensics PST Viewer's B-tree page scan surfaces these permanently deleted items by reading deallocated index pages directly.
What is the difference between soft delete and hard delete in Outlook?
Soft delete (Delete key) moves the email to the Deleted Items folder. The email is fully recoverable by enumeration. Hard delete (Shift+Delete or empty Deleted Items) bypasses Deleted Items and moves the message to the Recoverable Items dumpster for 14 to 30 days. After the dumpster window, the message becomes permanently deleted from Outlook's UI but the binary body often remains in the PST file's deallocated B-tree pages.
Does Outlook actually delete emails from the PST file?
No. Outlook flags messages as deleted in the PST's B-tree index but the binary body remains in deallocated pages until Outlook auto-compact runs or the PST is securely wiped. This is why forensic-grade PST viewers can recover messages Outlook has marked as permanently deleted: the data is still there, just no longer referenced by the active index.
Can I recover emails after emptying the Recycle Bin in Outlook?
Yes for the Recoverable Items dumpster window (14 to 30 days). After the dumpster expires, Sherlock's B-tree page scan recovers most messages from deallocated pages. The Recycle Bin in Outlook is the Deleted Items folder; emptying it triggers the hard-delete path to the Recoverable Items dumpster, not a true wipe.
How do I undelete emails from Outlook without restoring a backup?
Open the PST file in Sherlock Forensics PST Viewer. The viewer surfaces Deleted Items, Recoverable Items and permanently deleted messages via the four carving methods in a single scan. Export recovered messages to EML or MSG for re-import to Outlook or any other email client. No backup restoration required.
Can deleted emails be recovered from a corrupt PST file?
Yes in most cases. Sherlock's bounds-checked parser handles malformed B-tree pages, fresh-template garbage and partially-corrupted records silently rather than crashing. Even corrupted PSTs typically contain recoverable deleted-item data; Sherlock surfaces what is recoverable without modifying the source file.

Get Started

Download Sherlock Forensics PST Viewer Today

Free for viewing, searching and hash verification. Pro at $67 USD for export, forensic reports and chain of custody logging. Built by the same team that delivers expert witness testimony and forensic investigations in Canadian courts. Read our launch story. See also: how to open a PST file forensically, recover deleted emails from PST files, why PST files matter for eDiscovery, chain of custody software, forensic report generator and email preservation for litigation, workplace investigation evidence, free PST viewer comparison 2026, private investigator forensic tools and MSG + EML support in v1.2.0, MSG Viewer and EML Viewer.

Since 2006CISSP, ISSAP, ISSMP certified888.883.4550

Linux requires: libgtk-3-0 libxcb1 libxcb-render0 libxcb-shape0 libxcb-xfixes0 libxkbcommon0 libwayland-client0 libfontconfig1 (apt-get install on Debian/Ubuntu, dnf install on RHEL/Fedora). See install instructions.

Used for: eDiscovery, HR investigations, compliance audits, insurance claims, litigation support and data migration

Try the free version before you buy. Free tier previews 50 messages per folder with 3 file opens per day starting version 1.4.0. Forensic Edition removes both limits.

a3627992935119a7cb1fc730479c32af8b673247565a4799342e9b4d1c27b83b

How to verify:
1. Open PowerShell (right-click Start menu, click Terminal)
2. Run: Get-FileHash .\sherlock-pst-viewer.exe
3. Compare the output with the hash above. If they match, the file has not been tampered with.

Offline or full-version install

Download the full version

The quick installer downloads the AI models through the app on first run. The full version puts everything in one download instead, with no in-app fetch. Use it for a machine that will never be online. It also suits anyone who would rather grab one complete file up front. Pick the version that matches the machine's hardware, not a quality level. Each includes a single AI model. Most people should choose Standard.

Full version, Standard (1.6 GB)
Runs on a CPU or a modest GPU. Recommended for most machines. Download Standard
SHA-256: 18e870dffc6472bc9f137d0407e1cc15d745f80d5c22bc90ae02847331649be9
Full version, High accuracy (3.3 GB)
More accurate, but it wants several gigabytes of spare video memory and is slower on a machine with no discrete GPU. Download High accuracy
SHA-256: e98819277c8ac1af61acd2bb1815f6a186dfbb21079e679a46bbd56d3f302f5c

Sherlock Forensics PST Viewer is provided for lawful use. Terms of Service

Related Sherlock Tool

For mobile mail-analysis complement to PST Viewer, see the new Sherlock Forensics iPhone and iPad Analyzer. Windows forensic workstation for iOS logical MobileBackup2 acquisition. Parses iMessage, WhatsApp and SMS alongside 70+ additional iOS artifact views. Encrypted-backup offline decryption. Court-ready HTML report. Forensic Edition $599 one-time payment.

Download

Your email is optional. If you provide it, we send 3 product introduction emails over the next 2 weeks. No long-term marketing. No data sharing. Skip the field and download directly.

While you are here, make us your preferred source in Google:

Checkout - PST Viewer Forensic Edition

$67.00 USD. One-time payment. License key delivered to your email.

Secure via Stripe One-time purchase No subscription
Sherlock Forensics PST Viewer - $67