Outlook Data Files (PST and OST)

Outlook data files this user opened, exported PST files included, by full path.

Use it to find PST and OST files Outlook opened, such as mail exported to a USB stick or a cloud sync folder.

NTUSER.DAT
Office, Email and Cloud Apps

What It Is

Outlook keeps a list of the data files it has open for a user, the OST cache of a mailbox and any PST files, each by full path. A PST in an odd place, such as Downloads, a USB stick or a cloud sync folder, can mean mail was exported out of the mailbox. The list can keep an entry after a file is removed. It lives in the user's own NTUSER.DAT, under the Office version number.

What It Proves

Outlook had that PST or OST file open for this user, at that path. A PST in Downloads, on a USB stick or in a sync folder can mean mail was exported.

What It Does Not Prove

Entries can stay after a file is removed from Outlook or deleted, and nothing here says when each was added. The key sits under the Office version number, which is 16.0 for Office 2016 and later.

Where It Lives

Outlook Data Files (PST and OST) lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

NTUSER.DAT\Software\Microsoft\Office\16.0\Outlook\Search

C:\Users\<user>\NTUSER.DAT

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Outlook Data Files (PST and OST), each with what it tells you
Registry Value	What It Tells You
`C:\Users\alice\AppData\Local\Microsoft\Outlook\alice@corp.example.ost` `REG_DWORD0x00000001 (1)`	This OST is the local cache of alice's work mailbox, in its default folder. That is normal, so use it as the baseline for the other paths.
`E:\Clients\alice_mail_export.pst` `REG_DWORD0x00000001 (1)`	Outlook opened alice_mail_export.pst on the USB stick that was drive E, so mail may have been exported. Nothing here dates it, so if the stick is found, use the PST's file times.
`C:\Users\alice\Documents\Outlook Files\archive_2025.pst` `REG_DWORD0x00000001 (1)`	An archive PST sits in the default Outlook Files folder, the usual place for one. Collect it with the OST, because together they hold the mail she could have exported.

How to Read It

Each value name under Search, and in its search catalogue subkey, is the full path of a PST or OST file Outlook opened. OST files in AppData\Local\Microsoft\Outlook are normal mailbox caches, while PST files elsewhere deserve a look. Collect the files themselves, because a PST holds the mail, and its file times show when it was written.

When Windows Writes It: When Outlook opens a data file and adds it to the search index.
Which Windows Versions: Outlook 2016 to Microsoft 365 on Windows keep it here. Older versions use their own Office number.
Tools That Parse It: Registry Explorer, RECmd

Hunt It

The list of data files sits in this per-user key, so parse the hive, or read it live with Velociraptor, and collect the PST and OST files themselves. EDR file data shows a PST being written, with the process that wrote it.

Sees Related ActivityDeviceFileEvents

Reads the DeviceFileEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, which shows PST writes with the process that wrote them. Defender does not monitor every file type, so a miss proves nothing, and it does not read the Outlook key.

KQLDefender XDR, Advanced hunting

// PST files written on the device: exports, archives and copiesDeviceFileEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where FileName endswith ".pst" and ActionType in ("FileCreated", "FileModified", "FileRenamed")| project Timestamp, ActionType, InitiatingProcessAccountName, FolderPath, InitiatingProcessFileName

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Outlook Data Files (PST and OST) shows.

USBSTOR and USB Device KeysDates when the stick was connected, when a PST sits on a USB drive.
The PST and OST Files ThemselvesNot in the RegistryHolds the mail itself, and its file times date when each file was written.

Sources

The facts on this page come from these public pages, which say more on each point.