Hi,
I have a PST file for analysis and I have loaded my PST file into Encase 7, created a Logical evidence file and loaded the LEF into my case.
Then I created my keywords and Processed the case with keyword searching. Now I got my search hits. But now I need to mark the emails where those search hits occur, so I can export those emails as MSG files for analysis by the legal team.
But I can’t see any option that allows me to mark the emails so I can extract them.
As anyone faced this problem and knows how can I do that?
Thanks in advance
You need to use tag file option
What exact version are you running. I can blue check emails fairly easily. You may need to re-parse your evidence files with earlier 7x versions. Or close out all tabs except the Evidence tab to refresh Search hits.
You can see the overall structure of the PST within the Records tab.
Did you go to Search tab > Keywords sub-tab? Then select the keyword to be searched?
You can then generate a Result for each Keyword then go to the Results tab to combine Keyword results.