Notifications
Clear all

GMail Extraction

7 Posts
7 Users
0 Reactions
766 Views
(@tmy880)
Eminent Member
Joined: 17 years ago
Posts: 23
Topic starter  

I'm using EnCase version 6.15. Does anyone know how to carve out GMail from either allocated or unallocated?

Thanks


   
Quote
(@douglasbrush)
Prominent Member
Joined: 16 years ago
Posts: 812
 

Webmail/Browser based? Email Client? OS?

Need a bit more info…..


   
ReplyQuote
(@kovar)
Prominent Member
Joined: 18 years ago
Posts: 805
 

Greetings,

Gmail is very hard, nearly impossible, to carve out if it was being used via the web interface.

-David


   
ReplyQuote
(@jdcoulthard)
Trusted Member
Joined: 16 years ago
Posts: 98
 

Maybe this link will help

Sans Gmail Forensics


   
ReplyQuote
(@jgoss)
Trusted Member
Joined: 18 years ago
Posts: 59
 

Try this http//www.woany.co.uk/gmailparser/

I was just trying to find out exactly the same thing! (I think that program assumes that you can find and export the messages as htm files)


   
ReplyQuote
(@woany)
Eminent Member
Joined: 16 years ago
Posts: 28
 

You are correct about the gmailparser application. We had an instance where for whatever reason the browser had stored various artifacts on the hard disk.

Try Internet Evidence Finder (http//www.jadsoftware.com/home/ief.htm), not freeware ($49.99 or free to LE), but very good for all Internet based evidence e.g. Facebook, Gmail, Yahoo etc


   
ReplyQuote
CFP001
(@cfp001)
Eminent Member
Joined: 16 years ago
Posts: 36
 

One more vote for Jad's software, Internet Evidence Finder. If you want the previous version to test it out, PM me.


   
ReplyQuote
Share: