Hi everyone, doing some tests, does anyone knows how to joing all emails into one tab view Email?
When I click into a PST that was processed by View File Structure, it shows the emails, but if I have 5 PSTs, how to joing all emails into one view? I believe that is something similar with FTK does grouping all emails category.
2. Is there a way to add Emails columns into Result View?
3. When you select various attachments of emails, is there a way to automatically select the email, instead by BackSpace (Go To Parent) one by one?
Best,
Hi uriel,
1. To my knowledge the only way to open multiple PST's is to process the evidence using the "Find email" option which will then place the pst's / email data encase finds into the "Records" tab.
From here you can select the PST's or other datasets you wish to open and press the "Open" (folder looking) button under the tab ribbon…
2. Not to my knowledge but it does contain "From" and "Recipient" by default.
3. I'm not sure how you are going about this. When I select an attachment to an email in the evidence tab it automatically selects the email as well.
Perconter is correct; Encase V7 will parse all email during processing, if you ask it. You can also use the filter option to locate emails according to date range/to-from/subject blocks as well. Ensure you check the entire partition(s) prior to turning on the filter though.
1. I will try Find Email.
2. Yes it has by default, but not all columns like in Records Tab, I was also looking for True Path on Result Tab, and I have found the new version 7.08 has now.
3. I run a list condition name and md5, it shows a Result Tab, on that view I don´t have the email, but all are attachments, only if I double click is goes to Email, but more than 1000 to go one by one to select the entire email?
Thank you everyone.