To search for data in mailstorage (email) evidence:
1. Add evidence to a new or existing case.
2. Select the mailstorage, folder, or message in which the data will be searched.
3. Right-click and select Advanced Search or click Advanced Search on the Analysis tab, in the Search group.
4. The Search pane opens.
5. Enter the Search Parameters. The following group of parameters are available:
6. Click Start.
- Common parameters: These parameters include general information about what is to be searched.
- Special E-mail database parameters. Common Parameters: These parameters define where data is to be searched. They also include sender & recipient filters and date parameters.
- Special E-mail database parameters. Advanced Filters: These parameters define message filters.
7. The search starts. Its status is displayed in the Tasks pane and it can be stopped, paused, and started from there (via the right-click menu or using the Stop, Pause, or Start/Resume buttons).
8. The search results are displayed at the bottom part of the Search pane.
9. Double-click the search result to open it in the E-mail Data pane and view it.