Outlook Express mailstorage is stored in *.dbx files or the Outlook Express folder.
Mailstorage default location:
Windows 7, 8, 8.1, 10
The Application Data folder (AppData in Windows 7, 8, 8.1, and 10) is hidden by default.
If you want to add the whole mailstorage, navigate to the Outlook Express folder and do one of the following:
- Add this folder to Electronic Evidence Examiner.
- Add the dbx file to Electronic Evidence Examiner.
If you want to add separate user-specified folders from the mailstorage, navigate to them in the Outlook Express folder. For example, select the Inbox.dbx file to add the Inbox folder, Sent Items.dbx to add the folder with sent messages, etc.
To investigate Outlook Express mailstorage, do the following:
The messages that have been deleted from the trash in Outlook Express mailstorage cannot be restored. Only the trash content can be viewed.
1. Have the Add New Evidence window open.
2. In the Category list, select E-mail Database. In the Source Type list, select Outlook Express database. Click OK.
3. In the Select source for mounting window, select the Folder option to open the folder containing the mailstorage. Select the File option to open a *.dbx file.
4. If you select the Folder option, in the Browse For Folder window, navigate to the folder containing the Outlook Express database and click Open. If you select the File option, in the standard Open window, navigate to the *.dbx file and click Open.
5. Enter the Evidence name (by default, the name of the file to be added) and click OK.
6. The Outlook Express mailstorage is added to the case.
7. The mailstorage structure is displayed in the Case Content pane (to the left), messages stored in the mailbox are displayed in the Data View pane (to the right).
8. Select the message in the Data View pane. Its contents are displayed in the E-mail Data pane (at the bottom).
9. You can view the message contents in different formats and/or view the attachments.