For registration questions, please visit the Registration FAQ page.

Q: What evidence types is Network E-mail Examiner able to investigate?
A: Evidence is a link a link to a mailstorage (e-mail database) that allows the user to view its structure and contents and to examine it.

Note: When you add evidence to your workspace, evidence is not physically added to your case file. Instead a link is created to the physical location of your evidence. Therefore, you must keep the physical evidence in the same location each time you open a case file or you will be required to reassign it to reestablish its location.

Mailstorage consists of folders each of which can include messages which in themselves can have attachments (files of different formats attached to them).

Network E-mail Examiner supports the following types of mailstorages:

• Group Wise information stores
• Microsoft Exchange (EDB) information stores (versions 5.0, 5.5, 2000, 2003, 2007)
• Lotus Notes information stores (versions 4.0, 5.0, 6.0, 7.0, 8.0)

Each mailstorage can be opened with unique settings that can allow the user to receive more or less information about each mailstorage type. Notes: Mailstorage evidence can be examined not only as separate evidence but also as parts of filesystem evidence.

Q: Can I recover deleted emails?
A. Deleted emails can be recovered from Microsoft Exchange (.EDB) files.

Q: I notice a column named "Deleted" that contains a time stamp. What exactly does this date represent?
A: If an email has been deleted, it will be marked with a red X under the flag column. It will also have a time stamp of when it was deleted from the deleted items folder or deleted with Shift+Del.

Q: How do I add additional components (such as case history or supplementary files) into a report?
A: Network E-mail Examiner allows the user to define which supplementary files will be attached to the report. Supplementary files are placed into the folder in which the report is created and links to them are added to the report.

The Report Wizard page also allows you to define whether or not the Case History will be added to the report.

Case History Options:

• Include Case History: If this option is selected the Case History is added to the report.
• Export Case History to a file and add a link: If this option is not selected the Case History is added to the text of the report. If it is selected, the Case History is exported as a separate file and each link to it is added to the report.
• Supplementary files: Use the Add/ Remove buttons to add/remove file links that will be added to the report.

Q: How do I reassign message composition settings while printing?
A: To print a message:

1. Select the message to be printed in the Data Viewer pane.
2. Select Print in the File menu or right-click menu.
3. The Message Composing Settings window opens.
   
   The following settings become available:
   
   Composing mode: If the Simple option is selected, messages will be printed with the default options. If the Custom option is selected, the options of messages printing can be defined:
   • Message body: This option allows you to select what parts of message body will be printed.
   • Header: This option allows to select how detailed will be the printed message header
   • Recipients: This option allows you to select whether To, Cc and Bcc fields of the message will be printed.
   Print attachments. If selected, this option allows you to print attachments (containing text information or images) together with the message text.
4. Select the composition settings you wish to define.
5. Click on the Page Setup button to define a printer and paper options.
6. Click on the Preview button to preview the message before printing.
7. Finally click on the Print button to start printing a message under your defined settings.

Q: How do I clear a file sorting within Network E-mail Examiner? A: Clear sorting means to remove sorted files from the Sorted Attachments pane.

To clear sorted files:

1. Select the file (folder) whose contents should be removed from the Sorted Attachments pane.
2. Select Tools>Clear Sorting or right-click and then select Clear Sorting.
3. Sorted files are cleaned. The files which were cleared are now marked in black.

Q: What is the “Skip List” option? A: The Skip List is a list of storage IDs that, while processing (opening, exporting, searching), which may cause Network E-mail Examiner to fail. An ID is added to the Skip list automatically when Network E-mail Examiner fails to process it. There may be different reasons for such failures such as corrupted data, connection failure, etc.

The Skip List for each opened database is stored within the Registry. If you try to open the database again, you are asked to select the items that caused the problem in the past. Check the items you want to be skipped.

Notes: The more items you leave unskipped the bigger the probability that Network E-mail Examiner will fail while processing the data from this database.