Searching in Mailstorage Evidence
Posted by Jack H. Ward, Last modified by on 07 February 2018 10:00 AM

To search for data in mailstorage (email) evidence:

1. Add evidence to a new or existing case.
2. Select the mailstorage, folder, or message in which the data will be searched.
3. Right-click and select Advanced Search or click Advanced Search on the Analysis tab, in the Search group.
4. The Search pane opens. 

5. Enter the Search Parameters. The following group of parameters are available:

  • Common tab: These parameters include general information about what is to be searched
  • E-mail database tab: These parameters define where data is to be searched, sender & recipient filters and date parameters. You can also add filters to define message filters.

6. Click Start.
7. The search starts. Its status is displayed in the Tasks pane and it can be stopped, paused, and started from there (via the right-click menu or using the Stop, Pause, or Start/Resume buttons).
8. The search results are displayed at the bottom part of the Search pane. 
9. Double-click the search result to open it in the E-mail Data pane and view it.

 Advanced Search.png (16.59 KB)
(0 vote(s))
Not helpful

Comments (0)