Electronic Evidence Examiner allows you to export attachments (files attached to the message). Exporting attachments means creating a forensic copy of attachments on the computer on which Electronic Evidence Examiner is installed. Electronic Evidence Examiner allows you to export attachments of more than one message and even all attachments from the desired mailstorage.
To export all attachments, do the following:
1. Add the mailstorage evidence to a new or existing case.
2. The mailstorage structure is displayed in the Case Content pane (to the left), messages stored in the mailbox are displayed in the Data View pane (to the right).
3. Select the data to be exported. You can select the mailstorage, folder, or message. Use the Ctrl and Shift keys to select more than one item.
4. Right-click and select Export or select Export on the Export tab, in the Common Export group.
5. The Export Wizard opens.
6. On the Source and Output page of the wizard, select the Attachments Only output format.
7. Move between other pages of the wizard to set the options you need (for more information, please see the help file).
8. When all the parameters are defined, click Finish. The export process is displayed in the Tasks pane.
9. Once the exporting process is completed, navigate to the destination folder to view the results. When the export is performed, the MD5 is calculated for each exported attachment and placed in a separate file with the name <filename>.MD5.