Investigating Google Takeout Storage
Posted by Jack H. Ward, Last modified by Jack H. Ward on 06 February 2018 04:49 AM

Google Takeout storage is stored in the archive containing *.mbox file.

The Google Takeout archive is created in the location defined by the user.

To investigate the Google Takeout storage, do the following:

1. Have the Add New Evidence window open.
2. In the Source type list, select the Google Takeout storage and click OK.

3. In the standard Open window, navigate to the desired *.mbox file and click Open.
4. Enter the Evidence name (by default, the name of the file to be added) and click OK.
5. The Google Takeout storage is added to the case.

6. The mailstorage structure is displayed in the Case Content pane (to the left), messages stored in the mailbox are displayed in the Data View pane (to the right).

Only the read messages from Google Takeout storage are parsed in the current version of Electronic Evidence Examiner.

7. Select the message in the Data View pane. Its contents are displayed in the E-mail Data pane (in the bottom).

8. You can view the message contents in different formats and/or view the attachments.

 Google Takeout storage.png (38.28 KB)
(0 vote(s))
Not helpful

Comments (0)