OST & PST Forensics

OST & PST Forensics by Thegrideon Software is an advanced tool for MS Exchange and MS Outlook '.ost' and '.pst' files data access, analysis, deep recovery, review and export. It is designed to recover as much information as possible from any data source: valid '.ost' and '.pst' files, corrupted files, memory or drive images. OST & PST Forensics pieces together located data blocks into messages, contacts, notes, folders, attached files, etc. All Items properties are shown with additional reference to blocks and nodes IDs making it an ideal tool for detailed analyses and reporting.

Trial installer
2020.06.06
2.8 Mb / .exe

Trial portable
2020.06.06
2.7 Mb / .zip

Buy License Key »
Price: 99 USD per PC
including one year of free support

OST & PST Forensics Features:

Preview OST & PST Files Content:

view messages, notes, contacts, appointments, etc;
export or view attached data: documents, images, transport headers, etc;
access Properties Context in full;
view all the details saved in folders content tables;
view HTML messages in restricted mode to safely analyse files from unknown source;

Recover Deleted, Lost and Old Data:

access corrupted files;
access files with any part (or several parts) missing;
recover deleted messages, notes, contacts, etc;
track Nodes changes with old records recovered;
preview old content tables and compare versions;

Search data within Nodes by text or binary strings.
Export lists, tables and properties as XML files.
All Offline Storage (.ost) and Personal Storage (.pst) formats are supported.
Native WinAPI design - NO external libraries or frameworks to install.
Windows 7 - Windows 10.

Program Screenshots:

Inbox folder Content and Associated tables

Inbox folder old and new tables still available. HTML mail preview, Copy, Print, Change Encoding options.

Additional Details:

MS Exchange .ost and MS Outlook .pst are multi-layered database-based formats with small (up to several kilobytes) data blocks in its core. An ordinary simple message contains usually 2-3 blocks, a parent folder - 4 blocks minimum (content, hierarchy, associate content tables and properties). Plus several blocks are used to link and map this data. In case just one of those blocks is missing, Outlook treat this message as lost. OST & PST Forensics utilizes a new approach: find all accessible data blocks, restore and link back data hierarchy (messages, files, folders, etc.). This approach provides a possibility to restore a message with just one accessible and recoverable block. In reality message body can be stored multiple times as TXT, HTML and partially in folder content table, so any of the sources can be used to recovery the full version. Same principles are applicable to attached data (files, images). Exchange and Outlook .ost & .pst formats work similar to any database: all removed data blocks are marked as "deleted" and the space as "free" until it is replaced by any other data. This allows our tool to recover old data records and old versions of existing records. It is not uncommon to find tens of folder content tables versions, thus version and change tracking is possible. There are lots of additional features like text and binary search, hex viewer for data blocks and attached data, secured viewer for html based messages with links and active content disabled, message printing, properties lists and content tables XML export, etc.

Trial and Registration:

Trial version allows you to view data for Nodes with odd ID values only. Export is limited at 64Kb for attached files and images.