How to Perform Custodian Analysis on PST Files Using CSV Keywords

Author : Jaskirat Anand | Published On : 19 Oct 2026

A custodian is a person whose data may be relevant to a case. A PST custodian search means searching each custodian’s PST archives against one shared keyword list. Microsoft describes custodians as potential persons of interest in an investigation, added to cases and historically the core of the eDiscovery workflow. Purview eDiscovery searches Exchange mailboxes, OneDrive, SharePoint, Teams and Microsoft 365 Groups using Keyword Query Language (KeyQL). Google Vault likewise lets admins search by user account, organizational unit, date or keyword.

Both platforms assume the data still lives in the cloud. PST backups of departed employees, acquired companies or old archives don’t, and that gap is where a multi-custodian email investigation tool for offline files earns its place.

Why Use CSV Keywords?

• Consistency: every custodian is searched with the identical term list.
• Defensibility: you can show opposing counsel exactly what was searched.
• Speed: hundreds of terms load in seconds instead of being typed one by one.
• Repeatability: edit the CSV and rerun the case query.

Before You Start: Checklist

Stuck? If you don’t know which custodians matter yet, start with the people named in the matter and add more later. Adding custodians doesn’t invalidate earlier searches.

Step-by-Step: How to Perform Custodian Analysis on PST Files Using CSV Keywords

Step 1: Organize and Document the PST Collection

Before: PST files are scattered across drives and shares.
Do: Copy them into Case001/CustodianName/ folders. Record file names, sizes and, ideally, hash values in a log.
After: You have a clean evidence file collection where every file maps to one person.
If stuck: If you can’t tell whose PST it is, check the file path, the profile name, or the “From” and “To” patterns in a quick preview, and note your reasoning in the log.

Step 2: Load PST Files Under Custodian Profiles

Before: Download and install MailPro+ on Windows. The PST viewer opens ANSI and Unicode files without Outlook, keeps the folder hierarchy intact and offers 8 preview modes.
Do: Create a case, add a custodian profile for each person, and attach that person’s PST files to it.
After: The Custodian Panel lists each person with their folders (Inbox, Sent Items, custom folders) underneath.
If stuck: A file that won’t load may be corrupt or password-protected. The product page says it can preview damaged PSTs, but keep a note on any file you couldn’t fully read.

Free vs. full version: the free viewer is good for opening and reading. The vendor says advanced and wildcard search is in the full version. The demo is limited to 2 GB scans, 10 files per collection and 50 exported items, so test with a small sample first.

Step 3: Build a Clean CSV Keyword List

Before: You have a rough list of terms in email or Word.
Do: Put one term per row in a single column in Excel, then save as CSV (UTF-8). Include:

• exact phrases (“wire transfer”)
• spelling variants and misspellings
• code names, project names and nicknames
• wildcard stems such as contract*

After: A plain CSV with no merged cells, blank rows or hidden characters.
If stuck: If terms look garbled after import, re-save as UTF-8 and delete any header row the tool doesn’t expect.

Step 4: Import the CSV Keywords into the Search Module

Before: Your PST files are loaded and the CSV is saved.
Do: Open the search module, choose the CSV keyword import option and select your file.
After: The keywords appear as a list, and the term count matches your file.
If stuck: If the count is off, you probably have blank lines or duplicate rows. Fix the CSV and reimport.

Step 5: Run the Bulk Keyword Search Across Custodians

Before: Decide the scope: all custodians or a subset, plus a date range if the matter has one.
Do: Run the bulk search across all custodians and wait for the scan to finish.
After: Hits are flagged and grouped by custodian, so you can see at a glance whose archive contains which terms.
If stuck: If you get zero results, confirm the PSTs loaded fully and that wildcards or phrases are formatted as the tool expects. If you get thousands, your terms are too broad (see Step 7).

Step 6: Review Evidence in the Preview Modes

Before: You have flagged messages.
Do: Open them in Normal view, then use Header, MIME, Hex and MAPI Properties views when authenticity or sender details are in question. Check the Attachments tab too.
After: You can confirm context, sender, timestamps and attachments for each hit.
If stuck: If a hit is only in an attachment, open the Attachments mode instead of relying on the body text.

Step 7: Refine, Reduce False Positives and Export

Before: The hit list is noisy.
Do: Tighten broad words, add exclusion logic, narrow dates, and remove duplicates that appear in several custodians’ archives. Then export the results. The vendor lists 9 export options in the full version.
After: A defensible, reviewable set plus a record of the terms, dates and custodians searched.
If stuck: Rerun the search after each refinement and note the change in your log.

What Most Blogs Miss

• Cross-custodian duplicates: the same email sits in several archives. Decide up front whether you will dedupe globally or keep a copy per custodian, because it changes both counts and context.
• Search log: record the terms, date, scope and tool version. Courts and opposing counsel ask for it.
• Term-level hit counts: a word that hits 40% of all email isn’t a useful keyword. Test terms on a sample first.
• Attachment and header searching: keywords often live in attachments, not message bodies.
• ANSI vs. Unicode PST: older Outlook archives can be ANSI. Confirm your tool supports both.
• Chain of custody: work on copies and keep hash records.
• Tool limits: state whether your search ran on a demo or full version, since demo limits affect completeness.

Comparison: Cloud eDiscovery vs. Offline PST Analysis

Common Mistakes

1. Searching originals instead of copies.
2. Using vague one-word terms.
3. Forgetting spelling variants.
4. Skipping the search log.
5. Not testing on a sample first.

Conclusion

Once you know how to perform custodian analysis on PST files using CSV keywords, a task that used to take days becomes a repeatable process: organize, load custodians, import the CSV, run the bulk search, review, refine and export. Start with the free viewer to confirm your PST files open cleanly, then move to the full version when you need bulk search and export.

FAQs

1. How do I perform custodian analysis on PST files using CSV keywords?
Load each person’s PST under their own custodian profile, import a CSV keyword list into the search module, and run a bulk search to flag matches across all archives.

2. What is a custodian in an email investigation?
A person whose data may be relevant and must be preserved and reviewed.

3. Can I import a CSV keyword list to search PST archives?
Yes. Save one term per row as UTF-8 CSV and import it into the search module of a tool that supports it.

4. Do I need Outlook to search PST files?
No. Offline PST viewers open and read PST files without Outlook.

5. Is there a free PST viewer to group and analyze emails by custodian?
A free viewer can open and read PST files and keep folder structure. Advanced search, including bulk keyword search, requires the full version.

6. Can I search multiple PST files at once?
Yes. You can load several PST files per custodian and search them together. Demo versions cap the file count.

7. How many keywords can I use?
That depends on the tool. Start with a focused list of 20 to 100 tested terms rather than thousands of broad ones.

8. Does it support old ANSI PST files?
MailPro+ lists support for both ANSI and Unicode PST files.

9. How do I reduce false positives?
Use exact phrases, add exclusions, limit date ranges, and test terms on a sample before the full run.

10. Is this the same as Microsoft Purview or Google Vault?
No. Purview searches live Microsoft 365 locations, and Vault works on Google Workspace data. Offline PST analysis covers archives that live outside those platforms.