Privilege is a fundamental legal term and property which resist the disclosure of the confidential and private data. During the email forensic investigation mark email as privileged feature helps the investigators to protect the evidence by privilege confidential information. Most commonly the forensic investigations are work as teams. In such situations, privilege evidence option will restrict email access and disclosure of information by others.
In digital forensics, privilege is the concept used for confidential evidence protection. It helps the custodian to refuse the revealing of private data and maintain the secrecy. During the investigation process, collected email evidence may also contains private and personal informations, sharing of such information may leads to serious issues. To avoid such situations, the investigators provide privilege to evidences. So that the privileged email evidence can only be access by the respective person or others will restrict to perform some actions on it. By making the email data as privileged, the custodian restrict email access by others. This restriction allows the user to perform or access particular information by the others.
Confidential Evidence Protection option entitles a custodian to refuse to disclose some of their confidential communications with another party including the courts, tribunals, regulatory bodies and enforcement agencies. It is an absolute right and, once it has been established, can only be overridden in very limited circumstances. Follow the below section to understand the process of marking emails as privileged to protect the data from revealing.
The software considered to protect the privacy of certain information. The emails that needs to be protected can selected and can be locked using privileged evidence feature. To protect confidential information, select the evidences data from the mailbox. Use the Mark as Privilege button of email forensic tool to mark items in bulk or right click and choose the Mark Privilege option to restrict the email access of a single email.
As soon as Mark Email as Privileged option is executed, a lock icon appears in front of the selected emails. It signifies that the emails are now privileged evidence which are not available to disclose.
The privilege confidential information will not be available for exporting or converting. The Effort to export the privilege evidence information will generate error.
To remove privilege of emails that were previously marked as privileged, use the Remove Privilege button. This makes the email available for export.