Electronic Evidence Examiner allows you to export attachments (files attached to the message). Exporting attachments means creating a forensic copy of attachments on the computer on which Electronic Evidence Examiner is installed. Electronic Evidence Examiner allows you to export an attachment from an opened message.
To export an attachment, do the following:
1. Add the mailstorage evidence to a new or existing case.
2. The mailstorage structure is displayed in the Case Content pane (to the left), messages stored in the mailbox are displayed in the Data View pane (to the right).
3. Messages with attachments (files attached to them) have a special symbol in the corresponding column. For these messages, the Attachments tab in the E-mail Data pane is enabled.
4. In the Data View pane, select the message with the attachment. Its contents are displayed in the E-mail Data pane (at the bottom).
5. Click the Attachments tab in the bottom of the E-mail Data pane to view attached files.
6. Right-click the attachment and select Export.
7. In the Browse For Folder window, specify the location where the file will be saved.
8. Click the OK button to start exporting.
9. The export process is displayed in the Tasks pane.
10. Once the process of export is completed, navigate to the destination folder to view the results. When the export is performed, the MD5 is calculated for the exported attachment. It is placed in a separate file with the name <filename>.MD5.