SUBMIT A FILE TYPE CONTACT US SUPPORT ABOUT US

What Is an OST File? The Outlook Offline Mailbox Copy, and How to Open, Convert and Check One

An OST file is the local copy of a mailbox that Outlook keeps for a server account. Three readers opened all 7 of our test files and gave one answer on only 6 of 21 damaged copies. Jump to your question below, or work through it in order.

31 min read Updated November 2026 Checked against sources and tests

What Is an OST File? A mailbox copy for working offline, and what the ending hides

Short answer

An OST file is the local copy of a mailbox that Microsoft Outlook keeps for an account on a mail server. It lets you work offline, and the server keeps the original. Five of our seven OST files say SO in the header, and two say SM.

We tested 7 OST files with 3 readers. All 3 opened all 7, and they disagree on how many items 3 of the files have. We then damaged one file in 21 ways, and 6 copies gave one answer in all 3 readers.

To see inside one, use the open steps. To make an MBOX or EML file from one, use the convert steps. If your OST file will not open, begin with the causes.

An OST file is the local copy of a mailbox that Microsoft Outlook keeps for an account on a mail server. It lets you work offline, and the server keeps the original. The ending .ost does not name the kind, because the header does.

Picture a laptop on a train with no signal. Outlook still shows your mail, because it keeps a copy on the disk. That copy is an OST file. FileInfo says changes sync to the server after you reconnect.

Microsoft Support calls OST files always copies of items that are saved on a mail server. They go with Exchange accounts and with accounts that use the Outlook Connector for Outlook.com. Unlike a PST file, an OST file needs no backup, because the server stores the source data.

The Wikipedia article names the format the Off-line Storage Table. It says the file acts as a cache for the Cached Exchange Mode feature of Outlook. The same article says PST files are most common for archived items, while OST files keep items available offline.

You can make a new copy at any time. Microsoft says that disabling Cached Exchange Mode ends offline use, and enabling it again creates a new file. So Outlook can build a new OST file from the server.

Where our OST files come from

We studied 7 files. All are sample files that developers share for testing. Aspose.Email for .NET gave 3, java-libpst gave 1 and pst-extractor gave 3. We call the last three pst-extractor 1, 2 and 3 on this page.

The OST files are 271,360 to 16,818,176 bytes long, and the sizes add up to 71,896,064 bytes. We opened none in Outlook, because our lab uses Linux. We make no claim about what Outlook shows for these files.

So this page studies how OST readers treat OST files. Our three readers are libpff 20260926 through Python, pst-extractor 1.12.0 and readpst 0.6.76. The file command gave a quick look, and our own scripts did the rest.

OST file facts at a glance

Property Value
Meaning A local copy of a mailbox, made by Outlook for a server account.
Ending .ost. FileInfo names the type Outlook Offline Data File.
Maker Microsoft Outlook, per FileInfo and Microsoft Support.
First bytes 21 42 44 4e, the text !BDN, in all 7 of our files.
Letters at byte 8 SO in 5 of our files and SM in 2. The Microsoft header page gives SM.
Version at byte 10 23 in 3 of our files and 36 in 4.
Readers libpff, pst-extractor and readpst, all tested. FileInfo lists more programs.
Our tests 7 files, 21 damaged copies, 3 readers, a check script of 24 lines and a repair script of 13 lines.

Is your file a PST file? The PST file overview covers the Outlook archive format.

Which Kind of OST File Is Yours? Three kinds, and the header names the kind

Three kinds of file end in .ost in our tests. They are a version 36 offline file, a version 23 offline file and a personal storage file with an OST name. Bytes 8 to 11 of the file name the kind, and the ending does not.

Anyone can rename a file. All 7 of our test files start with the same four bytes, and all 3 readers opened all 7. The kinds differ in the two letters and the version number that follow. Follow the figure.

Decision chart with three kinds of file that end in .ost: four version 36 files with the letters SO and sizes that are multiples of 4,096, one version 23 file with the letters SO and a size that is not, and two version 23 files with the letters SM that the file command calls Personal Storage. The ending does not name the kind.
Figure 1. Three kinds of file that end in .ost, found by the header and not by the ending.

The kinds in detail

Kind Files and results
A version 36 offline file 4 of 7 files. The letters are SO, and every size is a multiple of 4,096 bytes. Three are from pst-extractor and one is from java-libpst. All 3 readers opened all 4.
A version 23 offline file 1 of 7 files. SampleOstFile.ost is 4,080,640 bytes with the letters SO. It has 92 items, and all 3 readers found all 92.
A personal storage file named .ost 2 of 7 files. The letters are SM, and file calls them Personal Storage. test.ost has 18 contacts and PersonalStorageFile.ost has none. All 3 readers opened both.

Check the first bytes

The file command named the kinds by looking at the header. It printed Offline Storage for the letters SO and Personal Storage for the letters SM. So it is a good first clue.

The file command on three kinds of OST file 
file SampleOstFile.ost test.ost example-2013.ost | sed 's/), .*/)/'
SampleOstFile.ost: Microsoft Outlook Offline Storage (>=2003, Unicode, version 23)
test.ost:          Microsoft Outlook Personal Storage (>=2003, Unicode, version 23)
example-2013.ost:  Microsoft Outlook Offline Storage (>=2003, Unicode, version 36)
Value What we measured
First 4 bytes The text !BDN in 7 of 7 files.
Letters at bytes 8 and 9 SO in 5 files and SM in 2. The Microsoft header page gives SM, and we did not find SO there.
Version at bytes 10 and 11 36 in 4 files and 23 in 3. The Microsoft header page lists 14 and 15 as ANSI and 23 or higher as Unicode.
Client version at bytes 12 and 13 12 in 5 files and 19 in the 2 SM files. The Microsoft page gives 19 for new files.
Encoding byte 513 1 in the 3 version 23 files and 0 in the 4 version 36 files. The Microsoft page lists 0 as none, 1 as permute and 2 as cyclic.
File size All 7 sizes are multiples of 512. The 4 version 36 files are multiples of 4,096, and the 3 version 23 files are not.
First bytes first The text !BDN names the family. Any other start was refused in all 3 readers.
The letters second SO or SM at bytes 8 and 9. The ending cannot show them.
The version third 23 or 36 at bytes 10 and 11. Version 14 or 15 is an older ANSI file.
The ending last Ours all end in .ost. The ending does not prove the contents.

Is it an Exchange database instead? The EDB file overview covers the mailbox store of an Exchange server.

What Is Inside an OST File? A header, pages and two trees

An OST file is a header followed by pages. Our example is 4,080,640 bytes, which is 7,970 pages of 512 bytes. Its header points to two trees, and the trees lead to 45 folders and 92 items. The header has two checks.

We looked inside one OST file because its layout explains every result later on this page. We chose SampleOstFile.ost from Aspose. The first bytes show the header.

The start of one OST file 
xxd -l 32 SampleOstFile.ost
00000000: 2142 444e 8c1f bb1d 534f 1700 0c00 0101  !BDN....SO......
00000010: 4000 0000 60bd 0e00 0400 0000 0100 0000  @...`...........

It starts with 21 42 44 4e, the text !BDN. Bytes 4 to 7 are a checksum. Bytes 8 and 9 are 53 4f, the letters SO. Bytes 10 and 11 are 17 00, which is version 23. Bytes 12 and 13 are 0c 00, a client version of 12.

Diagram of one OST file of 4,080,640 bytes in six parts: the header, the pages, the allocation maps, the block tree and the node tree, the folders and items, and the bytes that are checked. Three rules follow: the header must make sense, the pages must agree and readers must be compared.
Figure 2. One OST file from our tests, SampleOstFile.ost. The parts are not drawn to scale.

The parts, one by one

The header comes first, and the pages follow. Two small trees list where everything is. The block tree finds pieces of data, and the node tree finds folders and items. Allocation maps mark which pages are in use.

In our file the first map is at byte 17,408 and the last at byte 3,827,712. The block tree root is at byte 2,061,824 and the node tree root is at byte 2,068,480. libpff walks the node tree and lists 45 folders and 92 items.

The 92 items are 80 mail messages, 5 appointments, 6 meeting requests and 1 report. They have 39 attachments. Only 7 of the 45 folders contain items directly, and the others are empty or contain other folders.

ost_walk.py, a script of 6 lines that counts folders and items with libpff 
import pypff,sys
f=pypff.file(); f.open(sys.argv[1]); n=[0,0]
def walk(fo):
    n[0]+=1; n[1]+=fo.number_of_sub_messages
    for j in range(fo.number_of_sub_folders): walk(fo.get_sub_folder(j))
walk(f.get_root_folder()); print('folders',n[0],'items',n[1])
Its output 
python3 ost_walk.py SampleOstFile.ost
folders 45 items 92

What every part stores

Part What it stores
Header The first bytes of the file. Our script looks at the first 1,024. Copies A5 and A6 damage the first bytes, and all 3 readers refused them. Our repair script restores both.
Two checksums Bytes 4 to 7 cover 471 bytes from byte 8. Bytes 524 to 527 cover bytes 8 to 523. Copy B4 flips one header bit, and libpff refused it. Our repair script writes both checksums again.
File size field Bytes 184 to 191. Copy B5 sets it to zero, and libpff refused the copy. The repair script writes the actual file length.
The two trees The header points to both roots. Copies B6 and B7 zero those pointers, and all 3 readers refused them. Copies C6 and C7 zero the root pages, and all 3 readers refused those too.
Data pages The mail and the other items. We zeroed 496 single pages one at a time. libpff gave the same answer 306 times, a different answer 144 times and refused 46 times.
Folders and items Mail, appointments, meeting requests and a report in our file. The readers list them folder by folder.

What the public pages say about the layout

The Microsoft header page says the first four bytes are !BDN. It says the checksum at bytes 4 to 7 covers 471 bytes from byte 8, and that Unicode files have a second checksum over 516 bytes. Our script checks both, and both matched in 7 of 7 files.

The same page lists the encoding byte as 0 for none, 1 for permute and 2 for cyclic. Our files show 1 in three version 23 files and 0 in four version 36 files. Copy B3 sets the byte to 2, and all 3 readers refused it.

The map is small. Our script checks the header only. It looks at first bytes, version, both checksums and file size. It never looks inside a page, so it printed OK for 7 copies that the readers did not treat as the original.

What Did We Find in 7 Test OST Files? Three readers opened all 7, and they disagree on 3

We tested 7 OST files with 3 readers. All 3 opened all 7. The readers disagree on the item count in 3 files, and the gap comes from one calendar folder. The ending .ost did not predict any of it.

We counted an item when a reader returned a message, a contact or a calendar entry during a walk of every folder. libpff and pst-extractor gave counts. readpst makes files, so we counted the files it made. We counted attachments the same way for both counting readers.

Table of 7 test OST files with their version, letters, size and the number of items that libpff and pst-extractor found, next to four measured facts. All three readers opened all 7 files, and the item counts differ in three of them.
Figure 3. 7 OST files, three readers and four measured facts.
7 test files
7 opened in all 3 readers
3 with different item counts
0 refused by any reader

What the numbers show

Finding What we measured
Every file opens 7 of 7 files opened in libpff, pst-extractor and readpst. None of the three refused a good file.
Three item counts differ libpff finds 162 items in pst-extractor 1 and pst-extractor finds 26. The pairs for pst-extractor 2 and 3 are 183 against 47 and 214 against 70. The other 4 files agree, with 0, 18, 92 and 3.
One folder makes the gap The folder United States holidays is in all 3 files. libpff counts 160, 160 and 168 items in it. pst-extractor reports the same folder count and returns 24 items. The gaps of 136, 136 and 144 match.
Attachments agree Both counting readers find 0, 0, 39, 0, 12, 34 and 11 attachments in the 7 files. So the items that only libpff returns have no attachments.
The kind shows in the folders The 5 SO files list a folder named Root - Mailbox. test.ost, one of the SM files, lists Top of Personal Folders. PersonalStorageFile.ost, the other, has no items.
readpst makes one file per folder It made 0, 1, 6, 3, 2, 5 and 10 files. For SampleOstFile.ost it wrote no file for Deleted Items, which has 10 items in libpff. The -D option added that folder.
The largest files are the most different example-2013.ost has the same size as the three pst-extractor files, and the readers agree on it. So size does not explain the gap.

We do not know which count Outlook would show, because we used no Outlook. The folder count that pst-extractor reports matches libpff, and that points to the larger counts. We did not prove it.

What this study cannot show you

These are sample files from three projects, and developers made them for testing. A mailbox from daily use has years of mail, many folders and many attachments. A reader that passes here has shown that it opens small and medium samples.

We opened no OST file in Outlook, and we tested no password, no ANSI file and no file over 17 MB. We compared items, body lengths and attachment counts. We did not compare every property of every item.

What Happens When an OST File Is Damaged? 21 broken copies, and a quiet gap in the page checks

We damaged one OST file in 21 ways. All 3 readers gave the original answer on 6 copies and refused 11. On the other 4 they split. Our header script said OK on 11 copies, and 7 of those were not read as the original.

Our base file is SampleOstFile.ost, 4,080,640 bytes. We changed one thing at a time and saved 21 copies. Same means a reader returned the same items as for the base file. For libpff an item is a subject, a body length, an attachment count and a hash of the body and attachments.

For pst-extractor an item is a subject, a body length and an attachment count. For readpst the answer is the list of subjects in the files it wrote. Refused means an error and no items. Differs means a reader gave another answer. Follow the figure.

Grid of 21 damaged copies of one OST file against three readers, our check script and a header repair script. The readers gave one answer on 6 copies and refused 11 on all three.
Figure 4. 21 damaged copies, three readers, our script and a repair.

What the grid shows

Copies What happened
Wrong first bytes Copy A5 adds 16 zero bytes in front and A6 zeroes the first four bytes. All 3 readers refused both, and the repair script restored both.
A cut file Copy A2 cuts the file in half, A3 cuts it after 45,056 bytes and A7 keeps 1,024 bytes. All 3 readers refused all three. Copy A1 loses only the last byte, and all 3 readers gave the original answer.
Extra bytes at the end Copy A4 adds 1,024 zero bytes. All 3 readers gave the original answer. Our script warned about the extra bytes.
Wrong header numbers Copy B1 sets the version to 14, and B3 sets the encoding byte to 2. All 3 readers refused both. Copy B2 sets the encoding byte to 0. libpff gave the original answer, and the other two readers refused.
A bad checksum or file size Copy B4 flips one bit in the header and B5 zeroes the file size field. libpff refused both. pst-extractor and readpst gave the original answer. The repair script restored both.
Tree pointers and roots Copies B6 and B7 zero the header pointers to the two trees, and C6 and C7 zero the two root pages. All 3 readers refused all four, and the repair script cannot fix them.
A damaged page Copies C1, C2, C3 and C5 flip a byte, zero 64 bytes, zero a page or zero the first map page. All 3 readers gave the original answer on all four. Copy C4 swaps two pages, and libpff gave another answer while the other two did not.

The pattern has two sides. A damaged header is easy to see and easy to fix, because the repair needs only the first bytes. A damaged page is hard to see, because the readers can return the same items.

The readers differ in how much they accept. libpff gave the original answer on 7 copies and refused 13. pst-extractor and readpst gave the original answer on 9 and refused 12. Only on 4 copies did the three disagree.

The silent page damage

Copies C1, C2, C3 and C5 point to a risk. We changed a page, and every reader still gave the original answer. So we counted how many times that happens. We zeroed one page of 512 bytes at a time, in 496 places across the file, and used libpff on every copy.

libpff gave the original answer 306 times. It gave another answer 144 times and refused 46 times. So a file that opens is not proof that nothing is missing. The same answer can also mean that the page was unused or contained data that no item needs.

Our header script cannot see this damage, because the header is not changed. Only a comparison with a known-good copy, or with the server, shows a gap. So compare the item counts with the mailbox on the server.

Our script and the repairs

Our check script of 24 lines printed OK for 11 copies, WARN for 2 and FLAG for 8. Four of the 11 OK copies, C1, C2, C3 and C5, read as the original. The other 7 did not, because the script checks the header only. See the script.

The repair script of 13 lines restored 4 copies, A5, A6, B4 and B5. After the repair all 3 readers gave the original answer on those four. It cannot restore a cut file, a changed page or a zeroed tree. We did not test a repaired file in Outlook.

Copy A1 shows a limit of the check. Our script flags it, because the file is one byte shorter than the header says. All 3 readers still gave the original answer. So a flag is a reason to look, and it is not proof of loss.

What Does Our Expert Say About OST Files? A note from Neeraj Singh on trusting a file that opens

We asked our expert what the grid means for someone who has an OST file and has to decide if it is damaged. He looked at the 21 copies and at the 496 zeroed pages.

Neeraj Singh

Expert insight

Treat the mailbox on the server as the source and the OST file as a cache. Copy the file before you touch it, and never repair your only copy. In our tests, 306 of 496 zeroed pages went unseen, so a file that opens is not proof that nothing is missing.

Neeraj Singh Manager, Tech Support & Operations 19+ years fixing Windows and system errors

That advice fits the lab. Microsoft says an OST file is a copy of items saved on a server. The readers opened a damaged copy 306 times out of 496 with no change in the answer, so a quick open proves little. A copy of the file keeps the original safe while you check.

How Do You Open an OST File? Three readers, with the commands we tested

To open an OST file without Outlook, use libpff through Python, pst-extractor or readpst. All three opened all 7 of our OST files and left the file unchanged. We did not test Outlook. Copy the file first, and compare more than one reader.

The Microsoft Support page calls OST files copies of items on a server. Its title mentions opening or importing items, and the page gives no steps for opening the file by hand. So the usual route is Outlook with the account that made the file.

Outlook is not the only route. Programs without Outlook exist, and FileInfo lists several of them. Our lab uses Linux and has no Outlook, so we tested the three open source readers below.

Your options

readpst Tested A tool from the libpst project. Version 0.6.76 opened all 7 files and made MBOX or EML files from them.
libpff through Python Tested The pypff module, version 20260926, opened all 7 files and listed their folders and items.
pst-extractor Tested A package for Node, version 1.12.0, opened all 7 files. In 3 files it returned fewer items than libpff.
Microsoft Outlook Not tested The program that makes the file. Our lab has no Outlook.
Other programs Not tested FileInfo lists more programs, and several are free trials. We did not use them.

Copy first, then look

Work on a copy. Our readers only looked at the file. A SHA-256 hash of SampleOstFile.ost was the same before and after libpff, pst-extractor and readpst opened it. A copy still costs nothing, and it keeps the original safe from your own mistakes.

Look at the folders

Start with the folders and the item counts. The first command below makes a folder tree with one file per folder. The second command lists the files and their sizes. Deleted Items is skipped unless you add -D.

The folders of one OST file made by readpst 
readpst -r -o out SampleOstFile.ost
cd out
find . -type f -exec wc -c {} \; | sort -k2
364 ./SampleOstFile.ost/Calendar/calendar
1195792 ./SampleOstFile.ost/Inbox/mbox
45298 ./SampleOstFile.ost/Inbox/sub1/mbox
52541 ./SampleOstFile.ost/Inbox/sub2/mbox
1139947 ./SampleOstFile.ost/Sent Items/mbox
22675 ./SampleOstFile.ost/Sync Issues/mbox

The sizes are in bytes. Calendar is the only file with no mail, and Inbox is the biggest. In libpff the same file shows 45 folders and 92 items, and 7 of the folders contain items. The count of 6 files is lower because readpst skipped Deleted Items by default.

Copy the file first Our readers left the file unchanged, and a copy is still the safe habit.
Look at the folders Folder names and item counts show if the mail is there.
Use a second reader Three readers disagreed on 3 of our 7 files, and on 4 of 21 damaged copies.
Know the limit A reader can return the same items for a file with a zeroed page, as copies C1 to C3 show.

Is it a single message and not a mailbox copy? The MSG file overview covers the Outlook message file.

How Do You Convert an OST File to MBOX or EML? One tool, three commands, tested on one file

To convert an OST file to MBOX or EML, use readpst. Our example made 6 MBOX files, or 81 EML files and 1 calendar file. Deleted Items is skipped unless you add the -D option. We tested no tool that makes a PST file.

Both conversions left the OST file unchanged in our tests. We checked the results by counting the files they make and by comparing two exports. MBOX suits a move to a mail program that imports it. EML makes one file for every message.

Convert it to MBOX

The basic command makes flat files, one for every folder. Our example gave Inbox, sub1, sub2, Sent Items, Sync Issues and a calendar file, 6 in all. The files go into the output folder. Adding -D brought Deleted Items back, with 2 more files.

Two readpst commands for MBOX files 
readpst -o mbox SampleOstFile.ost
readpst -D -o mbox_with_deleted SampleOstFile.ost

Convert it to EML

The -e option makes one EML file for every message, and it puts calendar entries in ICS files. Our example made 82 files, which are 81 EML files and 1 ICS file. The 10 items in Deleted Items are the ones it skipped, and 82 plus 10 is the 92 that libpff lists.

Making EML files with readpst 
readpst -e -o eml SampleOstFile.ost
find eml -type f | wc -l
find eml -type f -name "*.eml" | wc -l
82
81

Two exports, two answers

We made the EML files twice. Both exports made the same 82 files. The totals were 2,451,991 and 2,452,094 bytes, so the text differs. The only differences are random numbers in the boundary lines and in one attachment name.

So do not compare two exports by hash. Compare file names and counts, or take out the random numbers first. The numbers do not change the messages.

Export Result
MBOX with -r 6 files in a folder tree. Inbox is 1,195,792 bytes and Sent Items is 1,139,947 bytes.
MBOX with -D 8 files. Deleted Items adds a mail file and a calendar file.
EML with -e 82 files, which are 81 EML files and 1 ICS file. Two exports gave the same names.
Two EML exports The totals are 2,451,991 and 2,452,094 bytes. Random numbers in boundary lines and one attachment name are the only differences.

What we did not test. We converted one file. We did not test an OST to PST conversion, a desktop converter, a web converter or a file with a password. We did not open any exported message in a mail program, and we make no claim about how one looks there.

Do you want to know what the output files are? The EML file overview and the MBOX file overview cover both formats.

How Do You Check an OST File? Six steps and a script of 24 lines

Check an OST file in six steps. Copy it first. Then look at its first bytes, make a header check, open it in two readers, compare the counts with the mailbox and compare a hash with a known-good copy. Our script of 24 lines checks the header.

  1. Copy the OST file, and work on the copy. Keep the original.
  2. Look at the first bytes with xxd -l 32 file.ost. They must start with 21 42 44 4e, the text !BDN.
  3. Check the header with python3 ost_peek.py file.ost. A good file prints OK.
  4. Open the copy in libpff and in readpst, and compare the folders and the item counts.
  5. If the account still works, compare the item counts with the mailbox on the server.
  6. Keep a SHA-256 hash of a known-good copy, and compare it with the file you have. Only a comparison finds a silent page change.

The check in Python

Our script of 24 lines checks the header with the standard library. It prints OK, WARN or FLAG with the problem it found. It checks the first bytes, the version, both checksums and the file size. It never looks inside a page.

ost_peek.py, 24 lines 
import struct,sys,os
T=[]
for i in range(256):
    c=i
    for _ in range(8): c=(c>>1)^0xEDB88320 if c&1 else c>>1
    T.append(c)
def crc(b,c=0):
    for x in b: c=T[(c^x)&255]^(c>>8)
    return c
def peek(path):
    b=open(path,'rb').read(1024); n=os.path.getsize(path)
    if b[:4]!=b'!BDN': return 'FLAG','no !BDN at byte 0'
    ver=struct.unpack('<H',b[10:12])[0]
    if ver not in (14,15,23,36): return 'FLAG','unknown version %d'%ver
    if ver<21: return 'WARN','older ANSI file: checks skipped'
    if struct.unpack('<I',b[4:8])[0]!=crc(b[8:8+471]): return 'FLAG','header checksum does not match'
    if struct.unpack('<I',b[524:528])[0]!=crc(b[8:524]): return 'FLAG','full header checksum does not match'
    eof=struct.unpack('<Q',b[184:192])[0]
    if eof==0: return 'FLAG','the file size in the header is zero'
    if eof>n: return 'FLAG','file is %d bytes shorter than the header says'%(eof-n)
    if eof<n: return 'WARN','%d extra bytes after the end the header gives'%(n-eof)
    return 'OK','header and size agree'
if __name__=='__main__':
    for p in sys.argv[1:]: print(os.path.basename(p),*peek(p))

What the script prints

First come three good files. Next is copy A1, which is one byte short. Then copy B1, which says version 14. Then comes copy C4, with two swapped pages. The script cannot see C4, and libpff gave another answer on it.

Six examples of the check script 
python3 ost_peek.py SampleOstFile.ost test.ost example-2013.ost A1.ost B1.ost C4.ost
SampleOstFile.ost OK header and size agree
test.ost OK header and size agree
example-2013.ost OK header and size agree
A1.ost FLAG file is 1 bytes shorter than the header says
B1.ost WARN older ANSI file: checks skipped
C4.ost OK header and size agree

The repair script

The repair script of 13 lines changes the header only. It cuts bytes in front of the !BDN text and puts the text back when it is zeroed. It writes the file length when the size field is zero, and it writes both checksums again. It restored 4 of our 21 damaged copies.

ost_fix.py repairs a damaged header 
python3 ost_fix.py B4.ost B4_fixed.ost
python3 ost_peek.py B4.ost B4_fixed.ost
B4.ost FLAG header checksum does not match
B4_fixed.ost OK header and size agree
ost_fix.py, 13 lines 
import struct,sys
from ost_peek import crc
def fix(b):
    i=b.find(b'!BDN',0,1024)
    if i>0: b=b[i:]
    elif i<0 and b[8:10] in (b'SM',b'SO'): b=b'!BDN'+b[4:]
    if b[:4]!=b'!BDN' or struct.unpack('<H',b[10:12])[0]<21: return b
    b=bytearray(b)
    if struct.unpack('<Q',b[184:192])[0]==0: b[184:192]=struct.pack('<Q',len(b))
    b[4:8]=struct.pack('<I',crc(bytes(b[8:8+471])))
    b[524:528]=struct.pack('<I',crc(bytes(b[8:524])))
    return bytes(b)
if __name__=='__main__': open(sys.argv[2],'wb').write(fix(open(sys.argv[1],'rb').read()))

Copy B4 had one flipped header bit. The script cannot know the original bit, so it writes the checksums for the header as it is. All 3 readers then gave the original answer, and that is the only proof we have. We did not test the repaired file in Outlook.

Know the limits. The script printed OK for 7 copies where at least one reader did not give the original answer. libpff also gave the original answer on 306 of 496 copies with a zeroed page. So an OK from one script is only a start, and a comparison with a known-good copy is the test.

Is an OST File Safe to Open? Listing folders is safe, and attachments need care

Listing the folders of an OST file starts nothing. Our 7 files have 96 attachments between them, and the names end in image, PDF, text, calendar, shortcut and Office types. We opened none of them and scanned none, so open files from sources you trust.

An OST file is a mailbox copy, and a mailbox contains attachments. SampleOstFile.ost has 39, and the three pst-extractor files have 12, 34 and 11. We looked at the names only. We did not open an attachment, start one or scan one for malware.

The endings are 47 png, 10 jpg, 9 pdf, 7 ics, 4 txt, 4 url, 1 doc and 1 xls. Another 13 attachments have no ending. None ends in .exe or .js. A name is only a label, so this is a hint about the files in our set and not a promise about yours.

Our lab only looked at OST files. We used three readers and our own scripts on 7 files, and we opened none in Outlook. We make no claim about what Outlook does with an attachment.

Listing folders is safe Listing folders and counting items started no attachment. A SHA-256 hash of the file was the same after the readers opened it.
The attachments are the risk 96 attachments in 4 files. We checked the names and not the contents.
Some endings need care Four attachments end in .url, one in .doc and one in .xls. We opened none, so we make no claim about them.
The ending is a label Two of our .ost files are Personal Storage files by their header. Look at the first bytes before you trust the ending.
The encoding byte is not a password Byte 513 is 1 in our version 23 files, and all 3 readers opened them as they are. We tested no password.
Work on a copy Our scripts leave the source alone. A copy still keeps the original safe from your own mistakes.

Five steps for a file you do not know

  1. Get the file from a source you trust, and keep the original.
  2. Look at the first bytes. An OST file starts with 21 42 44 4e, and anything else is another kind of file.
  3. Make a copy, and list the folders with a reader. Do not open attachments yet.
  4. Make EML files with readpst, and look at the attachment names in a text editor.
  5. Open an attachment only after you have scanned it with an updated tool.

What we did not test. We did not scan for malware or open any attachment. We did not open an OST file in Outlook. These steps lower the chance of a surprise, and they do not remove it.

Why Will Your OST File Not Open? Seven causes, and what to do about every one

Seven causes stop an OST file from opening or make it look wrong, and the file is the cause in only some of them. Start with the first bytes. A file that does not start with !BDN was refused by every reader we used.

Work down the list in order. Every cause comes from our 21 damaged copies or our 7 files, so every fix names a copy or a count. If the account still works, Microsoft says Outlook can create a new OST file at any time, and that is the safest fix for a damaged file.

1. The first bytes are wrong Copies A5 and A6 start with zero bytes, and all 3 readers refused them. Our repair script restored both. Check the first bytes with xxd -l 32.
2. The file is cut short Copies A2, A3 and A7 are cut, and all 3 readers refused them. Cutting only the last byte, as in A1, changed nothing. A cut file needs a new copy, because the missing pages are gone.
3. A header number is wrong Copy B1 sets version 14 and B3 sets the encoding byte to 2. All 3 readers refused both. Copy B2 sets the byte to 0, and only libpff gave the original answer.
4. A checksum or the file size is wrong Copies B4 and B5 gave libpff an error, and pst-extractor and readpst opened them. Our repair script restored both. Try a second reader first.
5. A tree pointer or root is zeroed Copies B6, B7, C6 and C7 lose a pointer or a root page, and all 3 readers refused them. Nothing in our tests fixed them, so get a new copy.
6. A page is damaged and the file still opens Copies C1, C2, C3 and C5 gave the original answer in all 3 readers, and C4 gave another answer in libpff. Compare the item counts with the mailbox.
7. The reader is the problem libpff refused B4 and B5 while two readers opened them. pst-extractor returned 24 items from a folder with a count of 160. Open the file in a second reader.

How Does an OST File Differ From a PST File? One family, two jobs, and two text exports

OST and PST files share a header and a family, and they serve different jobs. An OST file is a copy of a server mailbox, and a PST file is most common for archives. MBOX and EML are text exports. We tested the exports and not a PST conversion.

The table lists the neighbors of an OST file. We tested the rows for OST, MBOX and EML with one example file. The PST row comes from Wikipedia and from the header bytes of our files, because this page did not test PST files.

Type What separates it
OST file A binary copy of a server mailbox. 4,080,640 bytes for our example, with 45 folders and 92 items. It starts with !BDN and the letters SO.
PST file The same family of file, most common for archived items per Wikipedia. It starts with !BDN and the letters SM. Two of our .ost files show the letters SM.
MBOX files Text with many messages in one file. readpst made 6 files from our example, one for every folder with mail or calendar entries.
EML files Text with one message in every file. readpst made 81 EML files and 1 ICS file from our example.

OST or PST

The two files look alike inside. Both start with the text !BDN, and the file command names them by the two letters at byte 8. Microsoft says an OST file is a copy of server items. Wikipedia says a PST file is most common for archived items.

So the job decides, and the ending does not. Two of our seven .ost files are Personal Storage files by their header. If you need the details of PST files, the page on PST files covers them in depth.

OST or MBOX and EML

An MBOX file puts many messages into one text file, and an EML file stores one message. Both open in a text editor, which an OST file does not. The exports left out the 10 items in Deleted Items, and the OST file still has them.

Two EML exports of one file differ in random numbers, so compare counts and not hashes. A binary OST file keeps its pages, and a text export keeps messages. We did not test how a mail program shows either.

What Is the OST File Format Made Of? The facts we could check, and where they came from

An OST file stores a header and pages in one disk file, made by Outlook. Facts below come from our checks of 7 files and 21 damaged copies. Sources are Wikipedia, Microsoft, FileInfo and the test tools.

Part What we could check
Maker Microsoft. FileInfo lists the developer as Microsoft and names the type Outlook Offline Data File.
Name Off-line Storage Table, also called Off-line Folders (File), per Wikipedia.
Role Wikipedia calls it a cache for Cached Exchange Mode. Microsoft calls it a copy of items saved on a mail server.
Container A header followed by pages. Wikipedia describes an ANSI form with 32-bit pointers up to 2 GiB and a Unicode form with 64-bit pointers. Its Unicode limit is 20 GB for Outlook 2003 to 2007 and 50 GB from Outlook 2010.
First bytes The text !BDN, per the Microsoft header page. All 7 of our files agree.
Letters at byte 8 The Microsoft header page gives SM. Five of our files show SO and two show SM.
Version The Microsoft header page lists 14 and 15 as ANSI and 23 or higher as Unicode. Our files show 23 and 36.
Checksums One covers 471 bytes from byte 8, and a Unicode file has a second over 516 bytes, per the Microsoft header page. Both matched in our 7 files.
Encoding byte 0 for none, 1 for permute and 2 for cyclic, per the Microsoft header page. Ours show 1 or 0.
Readers FileInfo lists Outlook and several converters. We tested libpff, pst-extractor and readpst.

About the values we list

Layout facts come from our own tests of 7 files and from the pages we name. The PST article on Wikipedia gives the name, role and size limits. The Microsoft page on OST files gives the role and the new copy.

The Microsoft page on the header gives first bytes, version, encoding byte and both checksums. The FileInfo record for OST gives the maker and the programs. We could not load every part of those pages, and we make no claim beyond what we list.

What we left out

We used no Windows machine and no Outlook. We did not test ScanPST, an OST to PST conversion, a desktop converter, a web converter, a password or an ANSI file. We tested no file over 17 MB. Our readers worked on Linux, and other software can accept or refuse files that they treat differently.

The 7 public OST files come from three projects. Our damaged copies come from one file and change one thing at a time. We compared items, body lengths, attachment counts and hashes, and we did not compare every property.

Sources checked

For the format and its history, see Wikipedia on the PST format and Microsoft Support on OST files. For the header, see the Microsoft header specification. For programs, see the FileInfo page for the .ost ending.

Public test files come from the Aspose OST samples, the java-libpst test files and the pst-extractor test data. The libpff source is the library behind our Python reader.

Frequently Asked Questions About OST Files

What is an OST file?

An OST file is the local copy of a mailbox that Microsoft Outlook keeps for an account on a mail server. It lets you work offline, and the server keeps the original. Microsoft calls OST files copies of items saved on a server. The file starts with the text !BDN.

What does OST stand for?

OST stands for Off-line Storage Table, per Wikipedia. The article also calls the file Off-line Folders (File). It describes the file as a cache for the Cached Exchange Mode feature of Outlook.

How do I open an OST file?

Outlook opens the file for the account that made it. Without Outlook, readers like libpff, pst-extractor and readpst can list its folders and items. All three opened all 7 of our files. We tested no Outlook, so copy the file first.

What is the difference between an OST file and a PST file?

An OST file is a copy of a server mailbox, and a PST file is most common for archives, per Wikipedia. Both start with !BDN. The letters at byte 8 are SO in five of our .ost files and SM in two, and `file` calls the SM files Personal Storage.

How do I convert an OST file to PST?

We did not test a conversion to PST. We tested readpst, which makes MBOX and EML files from an OST file. For PST output, check the programs that FileInfo lists, and try one on a copy of the file first.

How do I convert an OST file to MBOX or EML?

Use readpst. The command `readpst -o out file.ost` makes MBOX files, and `readpst -e -o out file.ost` makes EML files. Our example gave 6 MBOX files, or 81 EML files and 1 ICS file. Add `-D` to include Deleted Items.

Can I delete an OST file?

Microsoft says Outlook can create a new copy at any time and that OST files need no backup, because the server stores the source data. We tested no deletion. Check with the person who manages your mail before you delete one.

Is an OST file safe to open?

Listing the folders of one starts nothing. Our 7 files have 96 attachments, and we opened none and scanned none. A mailbox copy can contain anything that was mailed to you. Open files from sources you trust, and work on a copy.

Why will my OST file not open?

One cause is a file that does not start with !BDN. Others are cut files, wrong header numbers, bad checksums, zeroed trees and a reader that is too strict. Start with the first bytes, then work down the cause list in the part called Why Will Your OST File Not Open.

Can I repair a damaged OST file?

Sometimes. Header repair restored 4 of our 21 damaged copies. It cannot restore a cut file, a changed page or a zeroed tree. We did not test ScanPST. Keep the original, and work on a copy.

Why do two readers show different item counts?

In 3 of our 7 files libpff found 162, 183 and 214 items while pst-extractor found 26, 47 and 70. One calendar folder explains the gap. pst-extractor reports 160 or 168 items for it and returns 24. We did not check which count Outlook shows.

Is a file that opens a good file?

No. When we zeroed one page at a time in 496 places, libpff gave the original answer 306 times. The same answer can also mean the page was unused. Compare item counts with the mailbox, and keep a hash of a known-good copy.

Still Stuck With an OST File? Where to go next, depending on what went wrong

Your OST file will not open

Look at the first bytes and use the check script. The cause list names what to try in order.

You do not know the kind

The kinds table names the kind, and the neighbors name the formats that look alike.

Is it a PST archive? The Outlook archive file page covers the PST file in depth.

Is it a single message? The Outlook message file page covers the MSG file.

Is it a generic data file? The DAT file page covers the .dat file type.

Is it an archive of files? The page on ZIP archives covers the compressed archive.

Is it a file type you do not know? Browse the file extension resource library, or send it on the submit a file type page.

Do you need the format facts? Read the format part for the layout and the sources of OST files.