Forensic Focus - Forensic Software - Email examination software

Forensic Focus

Forensic Software

Email examination software

Email examination software

Posted: Tue Jun 15, 2010 12:30 am
Author: Alex_ Location: Brussels
Hey everyone,

I've been following this forum for a while and noticed that there are many experienced people here so I thought I'd ask you guys for some advice.

For our (Belgian)firm we are looking into buying new software for email examinations, we simply used a clean outlook/thunderbird for this in the past but we've had a few issues with that of late. The indexing function of outlook 2007 takes forever to index a large mailbox and we're not to happy with the search quality either.

What software for reviewing e-mails do you use?

We are looking for something that can run on a simple laptop and is not too pricey(<1000$ per license) so we can buy everyone a license. Basic functionality we need is keyword search in mails content, headers and attachments, and preferably the ability to flag interesting mails for further review. Of course we'd like support for as many mail formats as possible but we encounter mostly pst/ost files, mbox and nsf

We have a trident license as well so deduplicating/merging functionality is not strictly necessary.

I already searched this forum but I couldn't find a recent thread discussing several software packages.

Thanks for any tips you can give us.

Re: Email examination software

Posted: Tue Jun 15, 2010 1:33 am
Author: Rampage Location: Italy
there are many software around, and a lot of them have also a try before buy version.

you can take a look at paraben email seizure if it fits your needs
www.paraben.com/catalo...cts_id=393

Re: Email examination software

Posted: Tue Jun 15, 2010 7:55 am
Author: douglasbrush Location: New York, NY
I like Paraben products as well for what you are talking about - quick and clean, low overhead and priced well.

Re: Email examination software

Posted: Wed Feb 22, 2012 4:10 am
Author: awiwoho Location: Jakarta
I like dtSearch, it is fast and doesnt take too much resources in the computer. And it is below 1K.

Re: Email examination software

Posted: Wed Feb 22, 2012 5:45 am
Author: Chris_Ed Location: Kent
I have a similar query, but regarding cases where there are a large number of documents / spreadsheets.

In some cases, we have a lot of docs & emails which need to be presented to users without much technical knowledge. It would be useful to have a (hopefully cheap) tool which would be able to index these documents, present them in a sensible manner, and allow certain searches to be performed.

Currently we either a) batch export them all and put up with a basic Windows search, or b) present them via EnCase. Neither is an especially satisfactory solution.

I know dtsearch does this, to some extent, but from our tests it looks like it misses some information - for example, as it turns everything into HTML, it seems to miss some embedded images in documents. We've also tested Archivarious 3000, which seems good (and is super cheap), but is not a forensic tool so we're a bit wary

Any pointers would be useful - especially if the software has a demo! Smile

Re: Email examination software

Posted: Wed Feb 22, 2012 11:15 am
Author: pragmatopian Location: Prague, Czech Republic
- Chris_Ed
I have a similar query, but regarding cases where there are a large number of documents / spreadsheets.

In some cases, we have a lot of docs & emails which need to be presented to users without much technical knowledge. It would be useful to have a (hopefully cheap) tool which would be able to index these documents, present them in a sensible manner, and allow certain searches to be performed.

Currently we either a) batch export them all and put up with a basic Windows search, or b) present them via EnCase. Neither is an especially satisfactory solution.

I know dtsearch does this, to some extent, but from our tests it looks like it misses some information - for example, as it turns everything into HTML, it seems to miss some embedded images in documents. We've also tested Archivarious 3000, which seems good (and is super cheap), but is not a forensic tool so we're a bit wary

Any pointers would be useful - especially if the software has a demo! Smile


I don't think you can beat dtSearch for quick and dirty reviews. There are many better solutions out there in terms of document management functionality (tagging, commenting etc) and a few that beat it in terms of indexing capabilities (speed, supported formats, robustness), but nothing at anywhere near its price point.

Regarding presentation of documents: you can set up external viewers to support document types of interest (under Preferences > External Viewers) if dtSearch's presentation doesn't meet your needs, or launch documents in the native application (if installed). Note that you need really high-end tools before you get integrated OCRing of image content, so certainly dtSearch isn't the appropriate tool if you need text recognition within embedded images.

Re: Email examination software

Posted: Wed Feb 22, 2012 1:06 pm
Author: jhup Location: Baltimore, MD USA
I also agree on dtSearch.

Although the interface is a bit quirky, it is hands down, best value for both small and large set of diverse data.

Love the new PST indexing without having to go through MAPI!

Re: Email examination software

Posted: Wed Feb 22, 2012 1:09 pm
Author: paraben Location: Utah
- Chris_Ed
I have a similar query, but regarding cases where there are a large number of documents / spreadsheets.

In some cases, we have a lot of docs & emails which need to be presented to users without much technical knowledge. It would be useful to have a (hopefully cheap) tool which would be able to index these documents, present them in a sensible manner, and allow certain searches to be performed.

Currently we either a) batch export them all and put up with a basic Windows search, or b) present them via EnCase. Neither is an especially satisfactory solution.

I know dtsearch does this, to some extent, but from our tests it looks like it misses some information - for example, as it turns everything into HTML, it seems to miss some embedded images in documents. We've also tested Archivarious 3000, which seems good (and is super cheap), but is not a forensic tool so we're a bit wary

Any pointers would be useful - especially if the software has a demo! Smile


You might want to try P2 Commander for this. It not only supports the email functions but you can load all your docs into it and have it index them and sort them into categories so anyone can easily look through them and perform simple or complex searches. You can get a demo from our website.

Re: Email examination software

Posted: Wed Feb 22, 2012 4:07 pm
Author: Chris_Ed Location: Kent
OK I'll take a closer look at dtSearch, and do some research into P2 Commander to see if it fits our needs.

Many thanks for the comments and suggestions!

Re: Email examination software

Posted: Fri Feb 24, 2012 11:52 am
Author: Cults14 Location: UK
Hi, depends on your volume of data and how deep your searching needs to be, but for relatively small data sets we use Discovery Attender for Exchange. No indexing required up front so it's a slow search initially, but you can index during the initial search so that you can carry out subsequent indexed searches within the 'found' results set.

HTH

Re: Email examination software

Posted: Mon Feb 27, 2012 2:52 am
Author: WarlocK88 Location: UK
Hey,
From my experience, Copernic desktop indexer does a great job. You can specify the PST that you want to index and it's searching abilities are fantastic. And the best part, it's free Smile
All times are GMT - 6 Hours
Page 1 of 1
http://www.forensicfocus.com/