To investigate a Windows 10 Mail database, do the following:
- Have the Add New Evidence windows open.
- In the Category list, select E-mail Database. In the Source Type list, select Windows 10 Mail. Click OK.
- In the Browse For Folder window, select the location of the source folder and click OK.
- Enter the Evidence name (by default, the name of the file to be added) and click OK.
- The Windows 10 Mail database is added to the case.
- The mailstorage structure is displayed in the Case Content pane (to the left), messages stored in the mailbox are displayed in the Data View pane (to the right).
- Select the message in the Data View pane. Its contents are displayed in the E-mail Data pane (at the bottom).
NOTE: The current version of the Electronic Evidence Examiner does not detect the email attachments, email size, as well as some email properties. For this reason, the Size column and some properties contain the Undefined value.