Electronic Discovery – Outlook Data Files

In terms of electronic discovery data, most of the e-mail we deal with comes from Microsoft Outlook. The server version of Outlook is called Microsoft Exchange. The client version is called Microsoft Outlook. Since most businesses are using Outlook in their course of business, we end up collecting Outlook data files most of the time in litigation matters. There are several data formats within the Microsoft Outlook family that could arrive at your desk. I will discuss 4 Outlook data file types.

PST – The most widely used format would be a PST file. In litigation support, we throw around this term constantly when discussing electronic discovery. Occasionally, we have to stop and answer the question, “what is a PST?” A PST is simply a container of Outlook e-mail. The PST file can be created in a number of ways and it can be created by IT folks or by the end user.

OST – Another format for Outlook e-mail is the OST file. Typically, these are found on laptops. If an Outlook user chooses to sync some of their e-mail to the local hard drive of the laptop to be accessed offline, for instance on a plane, then that e-mail will reside in a container called an OST file.

MSG – A single e-mail message is contained in an MSG file. You may receive a bunch of MSG files in a folder. Some of the MSG files will include the attachment(s) to the e-mail. This format is most often the result of a custodian trying to do their own e-mail collection.

EDB – If someone collects the custodian's mailbox directly from the Exchange server, they may provide it to us as an EDB file. There are tools to convert Exchange mailboxes into a PST format, so either format could come from the Exchange server.

Some things to note — a PST file can not be viewed in read-only format, for instance directly from a CD or DVD. In addition, an OST file is usually converted to a PST file using one of several tools available.


  1. One thing to be careful of with PST files is that if you delete emails from a PST and provide the PST to another party that the emails aren’t necessarily actually deleted from the PST. A better workflow would be to create a new PST, and copy relevant emails/folders between the old and new PSTs.

Leave a Reply

Your email address will not be published.