Sherlock PST Viewer Pro generates multi-page PDF forensic reports with SHA-256 hash verification per message, sender IP attribution from RFC-822 Received headers, SPF/DKIM/DMARC authentication results and chain of custody documentation. Reports are produced from read-only analysis with reproducible results.
Why Courts Accept Sherlock Reports
Every report produced by Sherlock PST Viewer Pro is built on six pillars of forensic integrity that courts require for digital evidence admission.
- SHA-256 per message
- Each email in the report carries its own SHA-256 hash. This allows independent verification of individual messages without requiring access to the full PST archive.
- Sender IP attribution from RFC-822 Received headers
- The report extracts and documents the originating IP address and hostname from the Received header chain per RFC-822. This establishes where each message actually originated.
- SPF/DKIM/DMARC per message
- Authentication-Results headers are parsed and included for each message. This documents whether the sender domain's email authentication passed or failed at the time of delivery.
- Chain of custody
- The report documents examiner identification, tool version, session ID, timestamp and source file SHA-256. Every action from file open to report generation is logged.
- Read-only analysis
- Sherlock PST Viewer never writes to the source file. The original evidence file remains byte-for-byte identical before and after examination.
- Reproducible results
- Any qualified examiner can open the same PST file in Sherlock PST Viewer and produce identical hash values and attribution data. The results do not depend on the specific examiner or machine.
What the PDF Report Contains
Each generated report is a multi-page PDF structured for court submission.
- Title page with case metadata including tool version, license holder, session ID, timestamp and source file SHA-256
- Per-email evidence cards with sender attribution (name, email address, source IP and hostname from Received headers) and Authentication-Results
- Recipient tables documenting To, Cc and Bcc fields with display names
- Body content with HTML converted to readable text
- SHA-256 hash computed individually for each message in the report
Mark Emails. Generate Report.
The workflow is straightforward. Browse or search the PST archive to locate relevant messages. Check the box next to each email you want included. Click Generate Report. Sherlock PST Viewer Pro produces the court-ready PDF with all forensic metadata included automatically. Marks are stored separately from the evidence file, preserving source integrity.