Free Download

Built in Rust

Open PST Files Without Outlook. Free.

Drop a PST or OST file and read your emails. Search, browse folders, view attachments. No Outlook, no Office 365, no subscription. Just your emails.

New in v1.2: native modern Outlook OST support (Outlook 2013+, Microsoft 365), whole-archive keyword search, one-click document export and per-folder PDF reports.

Also opens modern OST, MSG and EML files. See our dedicated OST Viewer page.

Sherlock Forensics PST Viewer opens PST, OST (including modern Outlook 2013+ OST), MSG and EML email files on Windows without Outlook. Browse folders, search messages, view attachments and export emails. Free to use. v1.3.0 adds native modern OST support, whole-archive keyword search and document export. The Forensic Edition at $67 adds pattern-based sensitive-data scanning, activity timelines, communication mapping, data recovery and court-ready PDF reports.

Linux requires: libgtk-3, libfontconfig1, libxkbcommon. See install instructions.

No install required· No signup· SHA-256 verified· Since 2006
Sherlock Forensics PST Viewer main screen with Open File and Open Folder buttons and left rail navigation

Drop a PST file and start reading your emails

New to PST files? See our step-by-step guide to opening PST files. Or see how we compare to other PST viewers.

New in v1.2.0

Native Modern OST Support

Sherlock Forensics PST Viewer v1.3.0 opens modern Outlook OST files used by Outlook 2013 and newer, Microsoft 365 desktop and cached-Exchange profiles. This is the 4 KB-page PFF-variant format that standard PST parsers reject. Also adds whole-archive keyword search, one-click document export, per-folder PDF reports and a unified findings catalog.

Modern OST

Native Modern OST

Opens 4 KB-page PFF-variant OST files (wMagicClient=0x4F53, wVer=36) used by Outlook 2013+, Microsoft 365 and cached-Exchange profiles. Full folder tree, message list and body preview. Free to use.

Modern OST Diagnostics

Authoritative counts derived from the NBT index: total messages, expected attachments, contents-table rows, orphan list. Verify extraction completeness against ground truth.

Orphan Detection

NIDs present in the NBT but absent from any folder are still enumerated. zlib DEFLATE decompression for compressed blocks. System-folder hiding for empty Outlook-internal folders.

Search and Export

Find in Archive

Whole-PST/OST keyword search across subject, body, from, to and attachment filenames. Background worker with streaming results. Session history lets you replay past searches instantly. Markable hits feed into report scope.

Export Documents

One-click extraction of all attached PDFs, Word, Excel, PowerPoint, OpenDocument, RTF, TXT and CSV files. Flat directory output with manifest.csv and SHA-256 per file. Scope picker and type filter.

Expanded Reports

Whole-archive PDF report (single searchable PDF of every email), per-folder reports and marked-only reports. Streaming PDF generator prevents OOM on multi-GB archives. Works on both PST and modern OST.

Forensic Improvements

Findings Catalog

Unified sidebar showing every accumulated result: current and historic searches, pattern-scan matches and Data Recovery item counts. Click any row to jump back to that result set.

Data Recovery Sidebar

Dedicated sidebar item running all 4 carving methods. Quality filter hides low-signal fragments by default. Click any recovered item for inline detail with Save raw bytes and educational forensic notes.

Crash Diagnostics

Structured crash logs with panic message, file:line, backtrace and version. Auto-detected on startup with one-click submission to Sherlock. Per-message crash isolation in search and extract workers.

v1.1.0

Full Forensic Workstation

Sherlock Forensics PST Viewer v1.3.0 transforms the viewer into a full forensic workstation with deleted-item recovery, pattern-based sensitive-data scanning, activity timelines, communication mapping, cross-archive search and multi-monitor support. Every new capability operates in read-only mode preserving evidence integrity.

Analysis Tools

Activity Timeline

Interactive histogram of all mailbox activity. Group by day, week, month or hour-of-day. Mouse-wheel zoom from full-archive down to single-day. Anomaly bars (volume > mean + 2 stddev) highlighted in yellow so off-hours bursts pop at a glance.

Communication Map

Force-directed graph of every sender/recipient relationship. PST owner pinned at center. Node sizes scale to message volume. Click any node for a sortable per-contact message list. Find collusion and unusual contact patterns at a glance.

Cross-PST Search

Load multiple custodians' archives into one search modal. Live substring matching across subjects, senders and recipients. Per-archive hit counts. Double-click any hit to jump straight into that PST, that folder, that message.

Sensitive Data Scanning

Pattern-scan every message body and attachment. Built-in rules for SSNs, credit cards (Luhn validated), AWS keys, Bitcoin (Base58Check), IBANs, phone numbers and IPv4. Format-validated to minimize false positives.

Pattern-based sensitive data scanning (SSN, credit card, AWS keys, IBAN)

pattern-based sensitive-data scanning

Sherlock Forensics PST Viewer cross-archive search across multiple PST files with per-archive hit counts

Cross-PST multi-custodian search

Forensic Recovery

Deleted-Item Recovery

Four independent carving methods scan unallocated PST space: regex scrape for RFC-822 headers, heap-on-node carving, compressed-RTF body recovery and B-tree zombie hunt. Per-method panic isolation. Confidence ratings on every recovered item.

MAPI Property Explorer

Every property the PST stores on a message in one filterable table. Hex IDs, named properties, raw value types. Read the Received hop chain, conversation index, message flags and internal Exchange properties.

Attachment Safe View

Preview attachments without opening them in the OS default handler. Type detection, hex header inspection, plain-text rendering of safe formats. Avoid drive-by exploits in adversarial archives.

Workflow

Multi-Monitor Analysis

Undock the Activity Timeline, Communication Map and Generate Report panes to their own OS-level windows. Drag to a second monitor, resize independently. The main app stays free for folder browsing.

Mark-and-Report

Marks persist across restarts (SHA-256 keyed). Shift+click range-mark. Show marked only filter. Per-folder badge counts. Report modal with per-row remove, PDF/CSV/JSON picker and auto-open on generation.

Verifiable Export

Every bulk export produces an Ed25519-signed manifest. Any third party can verify the export has not been altered using just a hash and a public key. No Sherlock install required to verify.

In-Message Search

Ctrl+F inside any message body. Every match highlights in place with next/previous navigation. Digit-aware mode: searching 1625941771559000 finds 1625 9417 7155 9000 with separators ignored.

Sherlock Forensics PST Viewer deleted email recovery showing recovered messages from unallocated PST space

Deleted email recovery with 4 carving methods

Sherlock Forensics PST Viewer email view with folder tree, message list, attachments and forensic buttons

Full email view with attachments and forensic tools

New in v0.1.6

MSG + EML Support

Sherlock Forensics PST Viewer v1.3.0 reads individual Outlook .msg and RFC-822 .eml messages with the same forensic rigor as the PST path. Open a single file or point it at an entire folder for batch analysis with optional recursive scanning.

What Examiners Can Now Do

  • Single file analysis - drop a .msg or .eml on the viewer for full subject/from/to/body/attachments preview in under a second
  • Folder mode - point it at a folder of messages and every .msg and .eml becomes a browsable list with optional recursive scanning
  • Visual triage - sort, filter and check off messages that matter, then generate a court-ready PDF covering just those
  • Attachment extraction - one click per file or bulk "Save all" with per-attachment SHA-256 logging (Forensic Edition)

Forensic-Grade Analysis

Every MSG/EML opened gets an automatic forensic readout alongside the normal preview:

Message Class Translation

Meeting requests, delivery reports, S/MIME signed messages and internal Exchange messages translated into plain language.

MSG Encoding Detection

Unicode vs ANSI encoding surfaced clearly. Critical for non-Latin character evidence.

MAPI Timestamps Side-by-Side

Created, Modified, Submit and Delivery timestamps shown together so divergences jump out immediately.

SMTP Transport Chain

Every Received header parsed into a visual hop-by-hop trail. Single-line origin-to-destination summary answers "where did this message come from" at a glance.

Authentication Results

SPF, DKIM and DMARC verdicts with plain-English explanations. Instantly see if the sender domain's authentication passed or failed.

Anomaly Flags

Missing sender, auth failures, internal Exchange messages, unverifiable signatures, Message-ID/sender domain mismatches. All flagged automatically.

Chain of Custody

  • Every file opened gets its own SHA-256 computed locally (never uploaded)
  • Folder mode produces a manifest hash - SHA-256 over every file's path + hash, reproducible by any third party
  • Every operator action (open, view, mark, save attachment, generate report) is appended to the per-evidence chain-of-custody log

Compare

Free vs Pro

FeatureFreePro ($67)
Open PST/OST files (including modern Outlook OST)YesYes
Open MSG/EML filesYesYes
Folder mode (batch MSG/EML scan)YesYes
View emails, contacts, calendarYesYes
SHA256 hash verificationYesYes
SMTP transport chain visualizationYesYes
SPF/DKIM/DMARC authentication resultsYesYes
Modern OST diagnostics (NBT counts)YesYes
Anomaly detection flagsYesYes
MSG encoding detection (Unicode/ANSI)YesYes
Chain of custody loggingYesYes
Crash diagnostics + submissionYesYes
Individual attachment saveYesYes
Multi-monitor detachable windowsYesYes
In-message Ctrl+F search (digit-aware)YesYes
Mark persistence across restartsYesYes
Find in Archive (whole-archive keyword search)-Yes
Cross-PST/OST search-Yes
Communication map (force-directed graph)-Yes
Activity timeline with anomaly detection-Yes
Sensitive data scanning (pattern-based)-Yes
Export Documents (bulk attachment extraction)-Yes
Reports (whole-archive / per-folder / marked-only)-Yes
Data Recovery (4 carving methods)-Yes
Findings catalog-Yes
Deleted-item recovery-Yes
Attachment safe view-Yes
Verifiable export container (Ed25519)-Yes
Export to EML/MSG-Yes
Mbox export-Yes
Court-ready PDF reports-Yes
Per-message SHA-256 hashing-Yes
Sender IP attribution-Yes
Priority support-Yes

Forensic Reports

Court-Ready Forensic Reports

Sherlock Forensics PST Viewer Forensic Edition generates multi-page PDF forensic reports with SHA-256 hash verification per message, sender IP attribution from RFC-822 Received headers, SPF/DKIM/DMARC authentication results and chain of custody documentation. Reports are produced from read-only analysis with reproducible results.

Why Courts Accept Sherlock Reports

Every report produced by Sherlock Forensics PST Viewer Forensic Edition is built on six pillars of forensic integrity that courts require for digital evidence admission.

SHA-256 Per Message

Each email in the report carries its own SHA-256 hash. Verify individual messages independently without needing access to the full PST archive.

Sender IP Attribution

Originating IP address and hostname extracted from the RFC-822 Received header chain. Establishes where each message actually came from.

SPF/DKIM/DMARC Per Message

Authentication-Results headers parsed for each message. See whether the sender domain's email authentication passed or failed at delivery time.

Chain of Custody

Examiner ID, tool version, session ID, timestamp and source file SHA-256 documented. Every action from file open to report generation is logged.

Read-Only Analysis

The source file is never written to. Your original evidence remains byte-for-byte identical before and after examination.

Reproducible Results

Any qualified examiner can open the same PST file and produce identical hash values and attribution data. Results do not depend on the examiner or machine.

What the PDF Report Contains

Each generated report is a multi-page PDF structured for court submission.

  • Title page with case metadata including tool version, license holder, session ID, timestamp and source file SHA-256
  • Per-email evidence cards with sender attribution (name, email address, source IP and hostname from Received headers) and Authentication-Results
  • Recipient tables documenting To, Cc and Bcc fields with display names
  • Body content with HTML converted to readable text
  • SHA-256 hash computed individually for each message in the report

Mark Emails. Generate Report.

The workflow is straightforward. Browse or search the PST archive to locate relevant messages. Check the box next to each email you want included. Click Generate Report. Sherlock Forensics PST Viewer Forensic Edition produces the court-ready PDF with all forensic metadata included automatically. Marks are stored separately from the evidence file, preserving source integrity.

Deleted-email recovery

Recover Deleted Emails from PST Files

When emails get deleted in Outlook, they do not always vanish from the PST file. Outlook moves them to the Deleted Items folder (soft delete). When you empty Deleted Items, the items go to a Recoverable Items dumpster retained for 14 to 30 days depending on retention policy (hard delete). Even after that window, the binary record often remains in the PST file as deallocated B-tree pages, invisible to Outlook but recoverable by a forensic-grade parser.

Sherlock Forensics PST Viewer delivers forensic-grade deleted item recovery using four carving methods to recover deleted emails:

  1. Deleted Items folder enumeration. Surfaces soft-deleted messages still sitting in the user's Deleted Items folder.
  2. Recoverable Items dumpster scan. Surfaces hard-deleted messages in the 14 to 30 day retention dumpster, the same store Outlook's "Recover Deleted Items From Server" relies on.
  3. B-tree page scan. Surfaces messages whose folder reference was deleted but whose binary message body remains in deallocated PST node pages, including emails that have aged out of the Recoverable Items dumpster.
  4. Slack-space carving. Surfaces fragments of permanently purged emails in the file's slack space between allocated B-tree pages, recovering message body fragments after Outlook's auto-compact has run.

The result: you can recover deleted emails and undelete the messages Outlook claims are gone, including permanently deleted items that have aged past the Recoverable Items dumpster window. The four carving methods run in a single scan against the PST file with full chain-of-custody logging. This is the same deleted item recovery surface that the Forensic Edition exports to court-ready PDF reports below.

Recovery matrix

Soft Delete vs Hard Delete vs Permanently Purged: What Is Actually Recoverable

Delete TypeWhat Outlook ShowsWhat Is In the PSTRecoverable by Sherlock?
Soft delete (Delete key)Item in Deleted Items folderFull message body in Deleted ItemsYes - trivial enumeration
Hard delete (Shift+Delete)Item gone from Deleted ItemsFull message body in Recoverable Items dumpster, 14 to 30 day retentionYes - dumpster scan
Permanently deleted (past dumpster window)Item completely gone from Outlook UIFolder reference deleted, body may remain in deallocated B-tree pagesYes - B-tree page scan recovers most
Compacted PST (Outlook auto-compact)Item gone, file size reducedSlack space may contain fragmentsPartial - slack carving recovers fragments
Securely wiped PSTItem gone, file size reduced, sectors overwrittenNothing recoverableNo - secure erase prevents forensic recovery

The deleted item recovery in Sherlock Forensics PST Viewer covers rows 1 through 4 in the matrix above. Row 5 (secure wipe) is not recoverable by any forensic tool because the binary content has been overwritten at the storage layer. For deleted emails that fall in rows 1 through 4, the deleted item recovery happens in a single Sherlock scan with chain-of-custody output. The same deleted item recovery feature handles permanently deleted Outlook items, hard-deleted messages past the dumpster window and slack-space fragments after auto-compact.

Pricing

One-Time Payment. Yours Forever.

Single License

$67 USD
1 machine. One-time payment, lifetime license.
  • All free features included
  • Deleted-item recovery (4 carving methods)
  • pattern-based sensitive-data scanning
  • Attachment safe view (sandboxed)
  • Verifiable export container (Ed25519)
  • Byte-level attachment extraction (single + bulk)
  • Export to EML/MSG formats
  • Mbox export
  • Batch export entire PST archives
  • Court-ready PDF forensic reports
  • Chain of custody logging
  • Priority email support

Team License

$335 USD
5 machines. One-time payment, lifetime license. Ideal for small forensic teams.
  • All Single License features
  • Activate on up to 5 machines under one license key
  • One purchase covers the team. Same lifetime guarantee.
  • Priority email support

Need more than 5 seats? Contact us for larger team pricing.

Use Cases

Who Uses Sherlock Forensics PST Viewer

Legal and eDiscovery

Law firms and litigation support teams use Sherlock Forensics PST Viewer to review email archives during discovery. SHA256 hashing preserves evidentiary integrity. The Forensic Edition generates forensic reports suitable for court filing. Pairs with our expert witness services for testimony support.

IT Administrators

Recover and review emails from departed employees without reactivating Exchange or Microsoft 365 licenses. Search archived PST files for specific communications during internal audits. No Outlook installation required on review workstations.

Forensic Examiners

Purpose-built for forensic workflows. SHA256 hash verification on every message establishes chain of custody. Export individual messages or entire folders for inclusion in forensic investigation reports. Used alongside our full forensic tool suite.

HR and Compliance

Review archived employee email for policy violations, harassment investigations or regulatory compliance. Search across entire PST archives by keyword, date range or sender without involving IT. Chain of custody logging in Pro maintains investigation integrity.

Personal Use

Access old email backups without an active Outlook license. Search years of archived correspondence. View contacts and calendar entries stored in PST format. The free edition handles all personal use scenarios with no restrictions or expiry.

Guide

How to Open a PST File Without Outlook

  1. Download Sherlock Forensics PST ViewerDownload the free installer from this page. 33 MB. SHA256 verified for integrity.
  2. Install and LaunchRun the installer on Windows 10 or 11. No admin privileges required. Launch from the Start menu.
  3. Open Your PST or OST FileClick Open File and browse to your .pst or .ost file. The viewer loads the folder structure and message list automatically.
  4. Search and BrowseUse the search bar to find emails by sender, subject or keyword. Browse Inbox, Sent Items, Contacts and Calendar folders.
  5. Verify and ExportView SHA256 hashes to confirm data integrity. Pro users can export to EML/MSG, generate forensic reports and log chain of custody.

Compare

Why Sherlock Forensics PST Viewer

Forensic Pedigree at a Fraction of the Cost

SysTools PST Viewer Forensic Edition costs $299 USD. Kernel PST Viewer charges $79 USD. Sherlock Forensics PST Viewer Forensic Edition is $67 USD with capabilities neither competitor offers: SHA256 hash verification per message, forensic report generation and chain of custody logging built by CISSP, ISSAP and ISSMP certified examiners with 20 years of courtroom experience.

Most PST viewers are built by software companies. Sherlock Forensics PST Viewer is built by forensic investigators who use it in active casework. The difference shows in the details: hash verification, evidence integrity and documentation that courts accept. Read our full 2026 PST viewer comparison or see our side-by-side PST viewer comparison table.

Changelog

Release History

v1.3.71 (2026-06-12)

  • A PST that is open in Outlook or locked by another process is no longer reported as an unsupported file. The viewer now explains that the file is in use and how to open it. Close Outlook or copy the file and open the copy.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: bac15d5abd58feed33bbae342e3046b46e7bfc0c824c2be17444a381d0f0f83d. TSA countersignature present, chains to 2034. Commit 84a4f26.

v1.3.7 (2026-06-10)

  • Archive-wide search is fast again on mailboxes with Microsoft 365 and Exchange compressed-RTF bodies. The text renderer no longer runs on every message during search.
  • The body decoder is hardened against malformed size fields.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.7 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 0d92715dc9b35b2bdc5fb923a5a25e83b93a75699d3f42920ce44e8716811104. TSA countersignature present, chains to 2034.

v1.3.6 (2026-06-10)

  • Fixes blank message bodies on Microsoft 365 and Exchange compressed-RTF mail. The decoder was misreading the compression flag bit polarity.
  • The forensic detail panel in the .msg and .eml view is now collapsed by default so the message body has room.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.6 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 0abb510c1710a5e3c471a6925df805eab1271a846f666e410b2c86877479cbd4. TSA countersignature present, chains to 2034.

Special Thanks

Special thanks to Greg Smith of Dundee Corporation. Greg isolated that the affected message bodies rendered correctly in Outlook but not in Sherlock. He cross-checked the hit counts against an Outlook search to confirm the discrepancy. Critically, he provided a forensically intact sample that preserved the original Microsoft Exchange compressed-RTF (PR_RTF_COMPRESSED / LZFu) data. That sample let us pinpoint and correct a flag-decoding error in our RTF decompressor. We are grateful for his diligence and patience.

v1.3.5 (2026-06-10)

  • Fixes blank message bodies on Microsoft 365 and Exchange eDiscovery exports where the body is stored as compressed RTF. The viewer now decodes these resiliently and displays the content.
  • Report-export no longer crashes on unusual body data.
  • A privacy-safe diagnostic helps support troubleshoot display issues.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.5 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 35daade76361a0b09a4f2c3accaa0b7eae71bc31b3c16847f09a520de85cc208. TSA countersignature present, chains to 2034.

v1.3.4 (2026-06-09)

  • Opt-in raw message body in the diagnostic panel. The privacy-safe diagnostic cog now offers an optional checkbox that includes the raw message body bytes when sending diagnostic info to support. The label tells you exactly what gets shared (just that one message's body, no attachments) before you opt in. Gives the customer-support decoder-fix loop a consent-based path to share the failing bytes that 1.3.3's blank-body fallback cannot yet decode. Support can then decode your exact bytes and ship a true fix in a follow-up.

Recommendation: Forensic Edition users on any 1.3.x build should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.4 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 6c03860a82fe3e84c68008d04d9b8c59e53e4e36c0fe8ee79c28fb7fcd24505b. TSA countersignature present, chains to 2034.

v1.3.3 (2026-06-09)

  • Fixes blank message bodies on Microsoft 365 / Exchange (eDiscovery) exports where the body is stored as compressed RTF.
  • Sender now shows the real SMTP address instead of the raw Exchange X.500 name. Subject lines no longer show stray leading glyphs.
  • Fixes a crash when exporting reports for messages with corrupt or unusual body data. Such bodies now display blank rather than garbled.
  • Adds a one-click, privacy-safe diagnostic (shares no email content) to help support troubleshoot display issues.

Recommendation: Forensic Edition users on 1.3.0 or any 1.3.2 build should update via the PRO badge in-app or re-download from the storefront. v1.3.3 is a drop-in replacement with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 90784ae3cb5590b43aa797ddc68d56f4edc293bd06d212daf7af4e6f37f04710. TSA countersignature present, chains to 2034.

v1.3.1 (2026-06-08). Bug-fix release for Exchange and OST handling

  • Compressed RTF body decompression. Exchange and OST messages previously previewed and exported with an empty body when the body content was stored in Microsoft's compressed RTF format. v1.3.1 decompresses the RTF and renders the actual body content in preview, search and every export format (PDF, JSONL, EML, MSG).
  • SMTP sender address resolution. The sender field previously displayed the raw Exchange X.500 address (/O=Org/OU=Group/CN=User) instead of the human-readable SMTP address. v1.3.1 resolves the X.500 name to the underlying SMTP address so reports and exports show user@domain.com instead of the internal directory path.
  • Subject line glyph scrub. Subject lines previously showed stray leading control glyphs in some messages. v1.3.1 strips these before display, search indexing and export.

Recommendation: Forensic Edition users on v1.3.0 should update via the PRO badge in-app. Free Edition users can re-download from the storefront. v1.3.1 is a drop-in replacement for v1.3.0 with no license-key changes required.

EV code-signed binary (Sherlock Forensics Ltd, SSL.com EV intermediate). SHA-256: 5f53b9fab2bab20b5d975ef291fe5151c66cd513892f7765116f8421576d173f. TSA countersignature present, chains to 2034.

v1.2.7 (2026-05-27)

  • Minor fixes for PST 2003 file parsing
  • Adds 1 MB header upload on failure-to-load for diagnostic submission

v1.2.0 (2026-05-23)

  • Native modern Outlook OST support (4 KB-page PFF-variant, Outlook 2013+, Microsoft 365, cached-Exchange)
  • Find in Archive: whole-PST/OST keyword search across subject, body, from, to and attachment filenames
  • Export Documents: one-click extraction of all attached PDFs, Word, Excel, PowerPoint and other files with SHA-256 manifest
  • Whole-archive and per-folder PDF report generation with streaming generator (no OOM on multi-GB archives)
  • Findings catalog: unified sidebar showing all search results, pattern-scan matches and recovered items
  • Data Recovery as dedicated sidebar item with quality filter and inline detail panels
  • Sens-Data Scan improvements: scrollable results, CSV export, click-to-jump to matched message
  • Modern OST diagnostics with authoritative counts from NBT index
  • Crash diagnostics with structured logs and one-click submission to Sherlock
  • System-folder hiding for empty Outlook-internal folders (MS-OLK-*, Sync Issues, etc.)
  • Bulk attachment extraction with scope picker (current folder vs whole archive) and type filter
  • Per-message crash isolation so one corrupt block cannot kill an entire scan

v1.1.0 (2026-05-13)

  • Multi-monitor support with detachable analysis windows
  • Activity timeline with anomaly detection for send/delete volume spikes
  • Communication map as force-directed graph with per-edge message filtering
  • Cross-PST search across multiple custodian archives
  • Pattern-based sensitive-data scanning with format validators (Luhn for credit cards)
  • Deleted-item recovery using four independent carving methods
  • MAPI property explorer for raw property inspection
  • Attachment safe view with sandboxed rendering
  • Verifiable export container with Ed25519 signatures
  • Mark persistence across sessions with range-mark, show-marked-only and folder badges
  • In-message Ctrl+F search with digit-aware matching

v0.1.6 (2026-04-18)

  • MSG and EML file support (single file and folder batch mode)
  • MSG encoding detection (Unicode/ANSI)
  • Recursive folder scanning

Questions

PST Viewer FAQ

Is Sherlock Forensics PST Viewer really free?
Yes. The free edition lets you open PST and OST files, browse all emails, contacts and calendar items, search across the entire archive and verify SHA256 hashes. No trial period and no feature expiry. The Forensic Edition at $67 USD adds export, forensic reporting and chain of custody logging.
Do I need Microsoft Outlook to open a PST file?
No. Sherlock Forensics PST Viewer opens PST and OST files without Outlook installed. It reads the PST format directly using its own parser. No Microsoft Office license required.
What is the difference between PST and OST files?
PST (Personal Storage Table) files are offline copies of mailbox data that can be moved between machines. OST (Offline Storage Table) files are local cached copies tied to an Exchange or Microsoft 365 account. Sherlock Forensics PST Viewer opens both formats.
Can I use this for forensic investigations?
Yes. The tool computes SHA256 hashes for every message, which establishes data integrity for legal proceedings. The Forensic Edition adds forensic report generation and chain of custody logging suitable for court submission.
What operating systems are supported?
Windows 10 and Windows 11 (64-bit) and Linux x64. Linux builds require libgtk-3, libfontconfig1 and libxkbcommon. macOS is not currently supported.
How large of a PST file can it handle?
Sherlock Forensics PST Viewer handles PST files up to 50 GB. Files over 20 GB may take longer to index on initial load. Performance depends on available system memory.
Is the $67 price a subscription?
No. The $67 USD Pro license is a one-time payment. No subscriptions, no recurring charges. You own the license permanently with free updates included.
How do I verify the download is safe?
Every download displays a SHA256 hash on the download page. After downloading, compute the SHA256 of the file and compare it to the published hash. If the values match, the file has not been tampered with. Use our Sherlock Forensics Hash tool or any SHA256 calculator.
Can I export emails from a PST file?
The Forensic Edition ($67 USD) supports exporting individual emails or batch exports to EML and MSG formats. The free edition is view-only with search and hash verification.
Do you offer volume licensing?
Yes. For 5 or more machines, contact Sherlock Forensics at 888.883.4550 or info@sherlockforensics.com for volume pricing.
Are Sherlock Forensics PST Viewer reports admissible in court?
Sherlock Forensics PST Viewer Forensic Edition generates forensic PDF reports with SHA-256 hashing per message, sender IP attribution extracted from Received headers, chain of custody documentation and read-only analysis verification. The tool is built by CISSP, ISSAP, ISSMP certified examiners with 20 years of courtroom experience. Admissibility depends on jurisdiction and proper evidence handling, but the reports document everything courts typically require for digital evidence admission.
How does per-message SHA-256 hashing work?
Each email in the PST archive is individually hashed using SHA-256 when included in a forensic report. This creates a unique cryptographic fingerprint for every message. Any modification to a single email would produce a completely different hash value, allowing independent verification of each message without needing to re-examine the entire archive.
Can I use Sherlock Forensics PST Viewer reports in civil litigation?
Admissibility depends on your jurisdiction and how evidence was handled throughout the investigation. Sherlock Forensics PST Viewer Forensic Edition reports document SHA-256 per-message hashes, sender IP attribution from RFC-822 Received headers, SPF/DKIM/DMARC authentication results, chain of custody and examiner identification. These are the elements courts typically require when evaluating digital evidence in civil proceedings.
Will Sherlock find emails the user deleted?
Yes. Sherlock Forensics PST Viewer v1.3.0 includes deleted-item recovery with four carving methods. It scans unallocated space in the PST file and recovers messages that were emptied from the Deleted Items folder. Recovered messages appear in a dedicated Recovered Items view with metadata intact where available.
Can I scan a PST for credit cards, SSNs and other sensitive data?
Yes. The pattern-based sensitive-data scanner in v1.3.0 detects credit card numbers, Social Security numbers, passport numbers and other PII patterns across every message in the archive. Each match is validated with format-specific checks such as Luhn for credit cards to reduce false positives.
Can I work on two monitors?
Yes. Sherlock Forensics PST Viewer v1.3.0 supports multi-monitor workflows. You can detach the message detail panel, the activity timeline, the communication map or any analysis window and move it to a second monitor. This lets you keep the message list on one screen and evidence detail on another.
Will my marks survive a restart?
Yes. Marks are persisted to a sidecar file stored alongside your evidence. When you reopen the same PST file your previous marks are restored automatically. The sidecar file never modifies the original evidence.
How do I search inside a long email body?
Press Ctrl+F while viewing a message to open the in-message search bar. The search is digit-aware so queries like 1234 will match 1,234 and 1234.00 as well as the literal string. Matches are highlighted with next/previous navigation.
Can I search across multiple custodians' PSTs at once?
Yes. Cross-PST search in v1.3.0 lets you open multiple PST files and run a single query across all of them. Results are grouped by source file with hit counts per archive. This is useful for multi-custodian eDiscovery where you need to find a keyword across several mailboxes simultaneously.
Does Sherlock Forensics PST Viewer work on Linux?
Yes. Sherlock Forensics PST Viewer is available as a native Linux x64 binary. Download the .tar.gz archive, extract and run. Requires libgtk-3, libfontconfig1 and libxkbcommon.
Can I recover deleted emails from a PST file?
Yes. Sherlock Forensics PST Viewer recovers deleted emails using four carving methods: Deleted Items folder enumeration, Recoverable Items dumpster scan, B-tree page scan for deallocated message bodies and slack-space carving for fragmented remains. The recovery works on soft-deleted, hard-deleted and permanently deleted items, including emails Outlook claims are gone.
How long are deleted emails recoverable from a PST file?
Deleted Items folder retains soft-deleted emails until manually purged (indefinite). The Recoverable Items dumpster retains hard-deleted emails for 14 to 30 days depending on retention policy. After the dumpster window expires, the B-tree page scan still recovers most messages from deallocated pages until Outlook auto-compact runs. Sherlock surfaces all four recovery layers in a single scan.
Can I recover permanently deleted emails from Outlook?
Yes in most cases. Even after the Recoverable Items dumpster expires, the binary message body often remains in the PST file's deallocated B-tree pages until Outlook auto-compact runs. Sherlock Forensics PST Viewer's B-tree page scan surfaces these permanently deleted items by reading deallocated index pages directly.
What is the difference between soft delete and hard delete in Outlook?
Soft delete (Delete key) moves the email to the Deleted Items folder. The email is fully recoverable by enumeration. Hard delete (Shift+Delete or empty Deleted Items) bypasses Deleted Items and moves the message to the Recoverable Items dumpster for 14 to 30 days. After the dumpster window, the message becomes permanently deleted from Outlook's UI but the binary body often remains in the PST file's deallocated B-tree pages.
Does Outlook actually delete emails from the PST file?
No. Outlook flags messages as deleted in the PST's B-tree index but the binary body remains in deallocated pages until Outlook auto-compact runs or the PST is securely wiped. This is why forensic-grade PST viewers can recover messages Outlook has marked as permanently deleted: the data is still there, just no longer referenced by the active index.
Can I recover emails after emptying the Recycle Bin in Outlook?
Yes for the Recoverable Items dumpster window (14 to 30 days). After the dumpster expires, Sherlock's B-tree page scan recovers most messages from deallocated pages. The Recycle Bin in Outlook is the Deleted Items folder; emptying it triggers the hard-delete path to the Recoverable Items dumpster, not a true wipe.
How do I undelete emails from Outlook without restoring a backup?
Open the PST file in Sherlock Forensics PST Viewer. The viewer surfaces Deleted Items, Recoverable Items and permanently deleted messages via the four carving methods in a single scan. Export recovered messages to EML or MSG for re-import to Outlook or any other email client. No backup restoration required.
Can deleted emails be recovered from a corrupt PST file?
Yes in most cases. Sherlock's bounds-checked parser handles malformed B-tree pages, fresh-template garbage and partially-corrupted records silently rather than crashing. Even corrupted PSTs typically contain recoverable deleted-item data; Sherlock surfaces what is recoverable without modifying the source file.

Get Started

Download Sherlock Forensics PST Viewer Today

Free for viewing, searching and hash verification. Pro at $67 USD for export, forensic reports and chain of custody logging. Built by the same team that delivers expert witness testimony and forensic investigations in Canadian courts. Read our launch story. See also: how to open a PST file forensically, recover deleted emails from PST files, why PST files matter for eDiscovery, chain of custody software, forensic report generator and email preservation for litigation, workplace investigation evidence, free PST viewer comparison 2026, private investigator forensic tools and MSG + EML support in v1.2.0, MSG Viewer and EML Viewer.

Since 2006CISSP, ISSAP, ISSMP certified888.883.4550

Linux requires: libgtk-3, libfontconfig1, libxkbcommon. See install instructions.

Used for: eDiscovery, HR investigations, compliance audits, insurance claims, litigation support and data migration

Try the free version before you buy. No limitations on viewing, searching or analysis.

bac15d5abd58feed33bbae342e3046b46e7bfc0c824c2be17444a381d0f0f83d

How to verify:
1. Open PowerShell (right-click Start menu, click Terminal)
2. Run: Get-FileHash .\sherlock-pst-viewer.exe
3. Compare the output with the hash above. If they match, the file has not been tampered with.

Sherlock Forensics PST Viewer is provided for lawful use. Terms of Service

Download

Your email is optional. If you provide it, we send 3 product introduction emails over the next 2 weeks. No long-term marketing. No data sharing. Skip the field and download directly.

Checkout - PST Viewer Forensic Edition

$67.00 USD. One-time payment. License key delivered to your email.

Secure via Stripe One-time purchase No subscription