Exporting means saving all or part of the case evidence in an external format.
Data exporting from Electronic Evidence Examiner can be performed in several ways:
- Exporting from the data View pane: This type of exporting allows you to save data displayed on the Data View pane to a spreadsheet.
- Exporting of mailstorage evidence: This type of exporting allows you to export mailstorage evidence to the selected file format through a special wizard.
- File/Folder exporting: This type of exporting allows you to export files and folders in their native format. This can be done for file system evidence, archive evidence, Xbox evidence, iTunes evidence, images from chat database evidence, attachments from mailstorage evidence, binary files in E3 mobile data case evidence, and thumbnails.
- Exporting of graphics and multimedia: This type of exporting allows you to export all files from the Graphics and Multimedia categories for the Sorted Files pane from a case.
- Sorted files exporting: This type of exporting allows you to export sorted files in their native format. It allows you to either export separate files or export entire categories of files.
- Batch Export: this type of exporting allows you to perform searches and filtering in multiple mailstorages of different formats and export the results to EML, EMX, MHT, MSG, PST, and Attachments only formats.
- Exporting GPS data to MapLink:This type of exporting allows you to export geographic location data in the KML format for further use in MapLink.
The MD5 for exported data (except the information in the Data View pane) is calculated while exporting. It is placed in a special file:
- For folders: The md5 file contains a list of all exported files from all folders and their MD5 hash codes.
- For files: The <exported file name>.md5 file is placed in the same folder as the exported file and contains its MD5.
To provide more security for the exported data, you can export it to a specially created Paraben's forensic storage container or a forensic container that encrypts the data and protects it from tampering.
Please note that, when exporting data to FAT32 file systems, name collisions might appear.
In FAT32, the maximum file path length is limited to 255 characters.
So, if data is exported to a destination with the FAT32 file system and has a full file path longer than 255 characters, it can't be saved and will be skipped while exporting.
Generally, this problem doesn't appear. But if you're not sure, please follow these recommendations:
- Export data to the NTFS file system.
- Avoid exporting data with big nesting to the FAT32 file system.
- Don't use the Save folders hierarchy option when exporting email data to a FAT32 file system.