Knowledgebase:
How to Add Windows 10 Mail Database Evidence from the Live Disk
Posted by , Last modified by on 25 June 2019 07:56 AM

NOTE: It is highly recommended to use the disk images for investigation because some services and processes might use or block certain files on a live disk. As a result, it might cause failure of some features.

If it is required to add Windows 10 Mail database evidence from the live disk, do the following:

  1. Add the required live disk evidence to a new or existing case.
  2. In the Case Content pane or in the Data View pane, navigate to the folder containing Windows 10 Mail database and select it.

NOTE: The default path to the Windows 10 Mail database is C:\Users\<windows_username>\AppData\Local\Comms

  1. On the Export tab, in the Common Export group, select Export, or right-click the folder and select.
  2. In the Exporting Options window, select Recursive and Export to folder.
  3. Define the location of the exported folder. Click Browse to navigate to the desired location.
  4. Click Export.
  5. After the export process finishes, click Add Evidence.
  6. In the Category list, select E-mail Database. In the Source Type list, select Windows 10 Mail and click OK.
  7. In the Browse For Folder window, select the location of the exported folder containing Windows 10 Mail database and click OK.
  8. Enter the Evidence name (by default, the name of the file to be added) and click OK.
  9. The Windows 10 Mail database is added to the case.
(0 vote(s))
Helpful
Not helpful

Comments (0)