Knowledgebase:
Searching in Mailstorage Evidence
Posted by Jack H. Ward, Last modified by Jack H. Ward on 08 February 2018 02:58 AM

To search for data in mailstorage (email) evidence:

1. Add evidence to a new or existing case.
2. Select the mailstorage, folder, or message in which the data will be searched.
3. Right-click and select Advanced Search or click Advanced Search on the Analysis tab, in the Search group.
4. The Search pane opens. 




5. Enter the Search Parameters. The following group of parameters are available:

  • Common parameters: These parameters include general information about what is to be searched.
  • Special E-mail database parameters. Common Parameters: These parameters define where data is to be searched. They also include sender & recipient filters and date parameters.
  • Special E-mail database parameters. Advanced Filters: These parameters define message filters.
6. Click Start.
7. The search starts. Its status is displayed in the Tasks pane and it can be stopped, paused, and started from there (via the right-click menu or using the Stop, Pause, or Start/Resume buttons).
8. The search results are displayed at the bottom part of the Search pane. 
9. Double-click the search result to open it in the E-mail Data pane and view it.





Attachments 
 
 Advanced Search.png (16.59 KB)
(0 vote(s))
Helpful
Not helpful

Comments (0)