Extract & Export Forensic Evidence
One of the most important phase in the eDiscovery process is the Production Phase. This phase constitutes of presenting the analyzed email evidences in a court validated and forensically sound format. Different authorities demand the presentation of evidences in various different formats e.g. the paralegals may require the forensic evidences to be presented in a PDF format whereas the reviewer may require to view the evidences in PST or EML format.
Application understands the practicality of this scenario and hence provides the users with an option to export email evidences into various output formats like EML, MSG, TIFF, PDF, Concordance, HTML, PST etc. Normally during the digital forensic investigation process the reports are created either for court proceedings or for the future reference purpose. In both cases the reports are generally created by export forensic evidence into various file format.
Importance of Exporting Forensic Evidence
During the court proceeding, evidence submission will always make the case more report strong and valuable. In Email forensics investigation to prove the digital crime is take pace through an email message, investigator can submit the documentary evidence of particular email message by export forensic evidence into PDF. Because of the originality and uneditable nature of PDF format make it more trustworthy infront of the court. PDF file format helpful in hard copy generation of report to submit in court.
Now you all thinking what is the need of export Email evidence into various file formats like EML, MSG, TIFF, CSV Concordance, HTML, PST ?
During the investigation process sharing of email evidences within the team members is a common process. But in every situation it is not possible that all the team members having email client/ software that supporting the same file format. In such situations transfer forensic evidence into different file format simplifies and fasten the investigation process.
- Export to PST, EML, MSG
Exporting email evidence into file format such as PST, EML, MSG will help to analyse the email messages with help of supporting email clients. This option help the investigators to examine the evidence without investigation tool. - Export to HTML/ HTML Report
Exporting email evidence into various file format also help to future reference of the evidence with the help of different email client and browsers. That is exporting the extracted evince into HTML/ HTML report format will help to access the evidence through different web browsers. HTML report will contain the addition report data such as “Folder path, From, To, Message size, Importance, Subject, Send & Received date with time etc.” - Export to EML, MSG
Convert forensic evidence into single email file format like EML, MSG are to maintain the confidentiality of the evidence by sharing the particular email data instead sharing of the entire evidence or report. - Export to CSV file
Transfer of email evidence into CSV file will only store the header information of the data such as “From, To, MD5, SHA1, subject, Message ID etc.”
Following table will help you to understand about the file formats and its supporting applications in short.
| File Format | Supporting Applications |
|---|---|
| EML | Mozilla Thunderbird, Outlook Express, Apple mail/Mac mail |
| MSG | Microsoft Outlook |
| TIFF | Image Viewers |
| Adobe reader, Any supported PDF viewer | |
| HTML/ HTML report | Web browsers like, Google, Firefox, Internet Explorer etc. |
| PST | Microsoft Outlook |
| CSV | Any spreadsheet application like Microsoft Excel, Libra etc. |
| Concordance DAT | Any text editors (Windows or Mac) |
Some Benefits of Export Features are listed below:
- The user DOES NOT need to have MS Outlook installed in his/her local machine to export the mails in PST format.
- Only the metadata of emails (the header information) can be exported and maintained in a CSV format.
- Users can print the email evidences directly by selecting the output format as "PRINT".
Transfer Forensic Evidence with Investigation Software
Users can select all or specific emails to export. After the selection click on the Export tab given on top of the navigation to transfer forensic evidence into different file formats.
Through the bulk export option the tool User can easily export forensic evidence from multiple folders or email file at once.
User can export forensic evidences into Concordance, CSV, EML, HTML, MSG, PDF, PST, TIFF through the export option tab.
Save the email as per the naming conventions provided in software. This option will help to manage the name of Email, Calender and Document files in different ways.
Check boxes available for options like "Maintaining the folder Hierarchy , Creating Top Folder , Merging Exported Files and Excluding Duplicates" help the users in streamlining the export outputs, for better understanding.
After selecting the file format to export email evidence, brows the desired location to save the resultant file.
