Exporting Mailstorage Evidence
Posted by Jack H. Ward, Last modified by Jack H. Ward on 29 January 2018 03:49 AM
|
||||
Electronic Evidence Examiner allows you to export a mailstorage to one of the following formats: EML (E-mail File), EMX (E-mail Examiner archive), and PST (Microsoft Outlook). Content-ID property of the exported EML message is the property that Electronic Evidence Examiner generates when exporting messages with attachments in case the original message doesn't have such property. This is performed to link an EML file with the attachment. The results of exporting to EML, MSG, and Attachments Only formats are folders containing exported data and a summary.md5 file containing the list of all exported files and their MD5 hash codes. The results of exporting to PST and EMX formats are files and an <exported file name>.md5 file placed in the same folder. Please note that PST files contain service data (checksums and IDs) that are unique for each PST file. Therefore, the MD5 calculated for the whole PST file will be different for PST files containing the same exported data. To export a mailstorage, do the following: | ||||
|