Exporting Mailstorage Evidence
Posted by Jack H. Ward, Last modified by Jack H. Ward on 29 January 2018 03:49 AM
Electronic Evidence Examiner allows you to export a mailstorage to one of the following formats: EML (E-mail File), EMX (E-mail Examiner archive), and PST (Microsoft Outlook).

Content-ID property of the exported EML message is the property that Electronic Evidence Examiner generates when exporting messages with attachments in case the original message doesn't have such property. This is performed to link an EML file with the attachment.

The results of exporting to EML, MSG, and Attachments Only formats are folders containing exported data and a summary.md5 file containing the list of all exported files and their MD5 hash codes.

The results of exporting to PST and EMX formats are files and an <exported file name>.md5 file placed in the same folder. Please note that PST files contain service data (checksums and IDs) that are unique for each PST file. Therefore, the MD5 calculated for the whole PST file will be different for PST files containing the same exported data.

The results of exporting to MHT format is an <exported file name>.mht file and an <exported file name>.md5 file placed in the same folder as the exported file and containing its MD5.

To export a mailstorage, do the following:

1. Add the mailstorage evidence to a new or existing case.
2. The mailstorage structure is displayed in the Case Content pane (to the left), messages stored in the mailbox are displayed in the Data View pane (to the right).
3. In the Case Content pane, select the mailstorage or the mailbox to be exported.
4. Right click and select Export or select Export on the Export tab, in the Common Export.
5. The Export Wizard opens.

6. On the Source and Output page, select the desired output format for the exported data.
7. Move between other pages of the wizard to set the options you need.
8. After all the selections are made, click Finish.
9. The exporting process is displayed in the Tasks pane. 
10. Once the exporting process is completed, navigate to the destination folder to view the result. When the export is performed, the MD5 is calculated for each exported file and placed in a separate file with the name <filename>.MD5.

 Exporting Mailstorage Evidence.png (29.02 KB)
(0 vote(s))
Not helpful

Comments (0)