To import data from the Office 365 cloud-based service:
- Start Electronic Evidence Examiner.
- Obtain the values required for the account authentication.
- On the Tools tab, in the Cloud Data group, click Import Office 365 Data.
- If there is no opened case, the New Case window opens where you can define the name and location of the created case.
NOTE: If the Ask a case name during automatic case creation option in the Common options is cleared, the case will be saved automatically to the default location and its name will be case<N>.e3
- Once the case is created, the Office 365 Data Import wizard opens and the Account page is displayed.
- On the Account page, enter the Application ID (Client ID), the Tenant ID, and the Application Secret (Client secret) assigned in the process of the application registration, and click Authenticate.
- The authentication starts. Its progress is displayed on the Authentication Process
- After the authentication process finishes, click Continue.
- On the Data for Importing page, the list of successfully authenticated email accounts will be displayed.
- If necessary, do the following:
- Select the Select custom date range for time related data check box and define the time interval for which the emails (inbox, outbox, etc.) from the selected email accounts must be imported.
- Select check boxes next to the email accounts in the accounts list, and then select check boxes next to the data to be imported from each email account. To import all data from an email account, select a check box next to it.
NOTE: Only folders available for the particular email account are displayed in the Available data pane.
- Click Import Data.
- The import process starts and a new Import data from Office 365 task is added to the Tasks pane, where you can view its general progress. The progress is also displayed on the Importing Progress page of the Office 365 Data Import
- When the data import is over, click Finish.
- Data is imported and added to the case. Every imported email account is added as a separate mailstorage evidence with the corresponding account name.