I have four large PST exports covering overlapping date ranges, with messages spread across many folders. Outlook search has been inconsistent. I need to find messages related to an incident and inspect full headers where available. What’s a sensible way to do this?
What’s a reliable way to search several large PST files?
Answers
If this is part of a legal or formal investigation, pause before opening the originals in Outlook or importing them elsewhere. Check with counsel or the team responsible for evidence handling, and use a forensic provider if you are not equipped to preserve and document the files properly. The right process depends on the requirements for the matter, not just which search tool is fastest.
At minimum, keep the originals unchanged, work from verified copies, and record what was done with them. A tool that can search PSTs is not automatically suitable for forensic work.
Reply to this answer
Can you still access the original mailbox or the system it was exported from? If so, ask the mailbox or compliance administrator whether a server-side search or e-discovery export is available. That can be easier to scope across folders and date ranges than searching several PSTs, and may provide a documented export process.
For a legal matter, coordinate that with counsel or whoever is managing discovery. Don’t re-import the files into a live mailbox just to make searching easier unless the process has been approved.
Reply to this answer
For an approved offline workflow, look at a dedicated PST viewer or indexing tool that can search multiple files and show message headers. Test it on copies first, and confirm it handles your PST versions, folder structure, attachments, and the fields you need before committing to a full search. Some tools are mainly viewers, so check that multi-file search is actually supported.
Full headers can include routing details such as IP addresses, but the information present varies by message. Keep a record of the search terms and review likely hits manually. Outlook may also return incomplete results while its index is still being built, but waiting for indexing does not by itself make a search forensic-grade.
Reply to this answer
Add your answer
Answers are reviewed before publication.
gulliverish:
The PSTs are what I have right now, so I’ll check whether the original mailbox is still accessible before trying to import anything.