PST file
A PST file is Microsoft Outlook's Personal Storage Table: a single file holding an entire mailbox, including messages, attachments, folder structure, calendar entries and contacts. In eDiscovery a PST is a container rather than a document, and processing must expand it into individual messages before anything inside it can be searched, reviewed or produced.
Also called: Outlook PST · personal storage table · OST file · NSF file · container file
Updated October 2, 2026
How does a PST file work?
A collected mailbox usually arrives as one file. Nothing inside it is addressable until processing opens it, walks the folder tree, and writes out each message and each attachment as a separate item with its parent recorded, which is how the family relationship is established.
Containers nest, and that is where the work is. A PST holds messages, messages hold attachments, an attachment may be a ZIP archive, and the archive may hold another PST. Processing expands recursively until nothing is left unopened, and anything it cannot open lands on the exception report: password-protected archives, corrupt regions, unsupported formats.
Two container variants show up alongside it. The OST is Outlook’s offline cache, tied to a profile rather than portable. The NSF is the IBM Notes equivalent, structurally different and handled by a different parser, which is why protocols and scoping conversations name it separately.
Format matters for one practical reason. Microsoft’s published specification for the PST format describes two variants: the older ANSI format, subject to a 2 GB size ceiling, and the Unicode format introduced with Outlook 2003, which raises it substantially. Legacy archives near the ANSI ceiling are a common source of corruption, because the format degrades badly as it approaches the limit.
What does a PST file look like in practice?
A single custodian’s PST at 12 GB. Using the rule of thumb the volume translator applies, roughly 10,000 email documents per gigabyte, that container holds on the order of 120,000 messages and attachments once expanded.
That figure is a planning estimate, not a measurement: the documents-per-gigabyte ratio comes from published analysis of about 2,000 hosted matters and varies with attachment density. What it is useful for is scale. One file dragged into an intake folder is roughly 2,200 reviewer-hours at the translator’s default of 55 documents per reviewer-hour, before any culling is applied, which is why the first question about a PST is what is in it rather than how big it is.
How does a PST file show up on an eDiscovery invoice?
A PST is where the processing meter reads, and the reading is worth pinning down. Per-GB processing charged on the container measures a file that includes empty space and deleted remnants. Charged on the expanded set, it measures what actually reaches review. The two differ, and no invoice explains which was used.
The Fee Field Guide records a related pattern to watch: a separate ingestion or loading fee charged alongside processing for what is functionally one step.
Corrupt and password-protected containers are the other cost. A PST that fails to expand is resolved by a person, and that appears as project management hours rather than per-gigabyte processing.
Worth asking: is processing measured on the container or on the expanded volume, is re-processing charged again if a repaired PST is reloaded, and how are exceptions inside containers billed.
Sources
- EDRM, Processing Standards on container expansion and exception handling.
- The Sedona Conference, Glossary: eDiscovery & Digital Information Management, “container file.”
- Microsoft, [MS-PST]: Outlook Personal Folders (.pst) File Format, the published specification for the format, on the ANSI and Unicode variants and the 2 GB ANSI limit.
- Documents-per-gigabyte figures:
src/data/volume.json, from published analysis of ~2,000 hosted matters and 150M+ documents. - Fee ranges and documented rates: the Fee Field Guide dataset.
Related terms
Processing · Collection · Metadata · Deduplication · Custodian · Email threading
eDiscovery at one flat monthly rate
$3,250 a month on a 12-month agreement. No per-user fees and no per-GB hosting charges.
Common questions
What is the difference between a PST and an OST?
A PST is a portable mailbox file that can be opened on any machine with Outlook. An OST is the offline cache of a server mailbox, tied to the profile and account that created it, and it is not designed to be moved or opened elsewhere. Collections take PSTs, or pull from the server directly through an API. An OST recovered from a laptop image can usually be converted, but it is a salvage route rather than a collection method.
Can you review documents inside a PST directly?
Not usefully. Opening a PST in Outlook shows the messages but produces no hashes, no extracted text index, no deduplication and no defensible record of what was looked at, and browsing it can alter read status and other metadata. Review happens after processing has expanded the container into individual documents with their metadata extracted into fields.
Why does the processed volume not match the size of my PST?
Because the two measure different things. A PST includes empty space, deleted-item remnants and the file's own structure, and Outlook can compress the contents, so the expanded messages and attachments frequently total a different figure from the container. Whether the per-GB meter reads the container or the expanded set is a question worth asking before processing is billed.