Dear All
I have been requested to extract EDB and STM files from an Exahange server - I belive it to be Exchanges 2003.
Could someone with experiance tell me if I have any security or passowrd issues. I foresee myself extracting the EDB and STM files from the exchange box and then placing them in a LEF.
When I bring the LEF back to the lab and mount the LEF in Encase will I have any security or access issues on the EDB files when I am carrying out the review in Encase. Should I request the exchange Admin user name and password? Also if the Exchange box is 2010 will any password issues arise?
Thanks for the help !
James
No, you should be fine. I've done many EDB and STM examinations (although with FTK 3) and never got any issue.
When extracting the EDB and STM files, just make sure that the Exchange services are completely shut down. Otherwise, you might end up with access errors and some incomplete (or empty) files.
Thanks HitMan much appreciated
FYI, Paraben's Enterprise tools allow you to acquire PSTs from live Exchange servers without data loss or access errors.