An application is not the mailbox service

Classic Outlook, new Outlook for Windows, Outlook for Mac, web access and mobile clients do not have identical storage or export behaviour. Outlook.com, Hotmail and Live consumer accounts must be distinguished from an organisation's Exchange environment. Enterprise holds and administrative sources must not be assumed to exist for a consumer account.

  • Record the application, operating system, version and configured account type.
  • Identify whether the evidence is an existing file, a live account, a device or a previous export.

What PST, OST and MSG can contribute

A PST is an Outlook data file that may hold exported or locally stored items. An OST is associated with offline synchronisation in applicable Outlook configurations. An MSG represents an individual Outlook item. Their value depends on provenance, contents and the producing application. A cache may cover only part of the server mailbox.

Current Microsoft documentation includes PST export paths for classic and new Outlook, but the availability and behaviour of particular functions must be checked against the installed build. Do not infer that every Outlook client creates an OST or supports the same export workflow.

Limits of an export

Microsoft documents that classic Outlook export does not include every setting or property of the account, such as message rules. Cache and folder selection can limit the exported population. A readable PST therefore does not establish complete preservation of the account, audit history or all attachments linked from messages.

Different exports can represent the same communication differently. Compare the message content, properties and context before treating unequal file hashes as evidence of alteration.

Preserve existing material

Retain original files and their surrounding context before repair, import, conversion, compaction or profile recreation. Those operations can change the evidence. Work from verified copies under an agreed method, and record any actions already taken. Do not synchronise an old device solely to make its view match the current mailbox before assessment.

  • Note where each file came from, its custodian and any export settings.
  • Identify backups and other endpoints without assuming they contain the same population.

Questions an examination may address

An agreed examination may compare supplied messages, identify inconsistencies, reconstruct a qualified chronology or document the accessible contents of a file. It cannot guarantee recovery of deleted material or identify a human author from a display name alone. Send a short description of the account and files for feasibility assessment; transfer evidence only through the agreed procedure.

Sources & further reading

Primary references support the technical explanation. They do not establish D3 validation of a particular method.