NOTE: It is highly recommended to use the disk images for investigation because some services and processes might use or block certain files on a live disk. As a result, it might cause failure of some features.
If it is required to add Windows 10 Mail database evidence from the live disk, do the following:
- Add the required live disk evidence to a new or existing case.
- In the Case Content pane or in the Data View pane, navigate to the folder containing Windows 10 Mail database and select it.
NOTE: The default path to the Windows 10 Mail database is C:\Users\<windows_username>\AppData\Local\Comms
- On the Export tab, in the Common Export group, select Export, or right-click the folder and select.
- In the Exporting Options window, select Recursive and Export to folder.
- Define the location of the exported folder. Click Browse to navigate to the desired location.
- Click Export.
- After the export process finishes, click Add Evidence.
- In the Category list, select E-mail Database. In the Source Type list, select Windows 10 Mail and click OK.
- In the Browse For Folder window, select the location of the exported folder containing Windows 10 Mail database and click OK.
- Enter the Evidence name (by default, the name of the file to be added) and click OK.
- The Windows 10 Mail database is added to the case.