Title: 5. Using Specialized E-mail Forensics Tools
Course: IN 2005 Digital Forensics > Section: Module 12: Chapter 12 -E-mail Investigations

Using Specialized E-mail Forensics Tools

1. Some of the tools that can be used for e-mail investigations, including:
  - AccessData’s Forensic Toolkit (FTK)
  - ProDiscover Basic
  - FINALeMAIL
  - Sawmill-GroupWise
  - DBXtract
  - Fookes Aid4Mail and MailBag Assistant
  - Paraben E-Mail Examiner
  - Ontrack Easy Recovery EmailRepair
  - R-Tools R-Mail
2. These tools enable you to find:
  - E-mail database files
  - Personal e-mail files
  - Offline storage files
  - Log files
3. See Figures 12-21 and 12-22 to illustrate how to use FINALeMAIL and for e-mail investigations.

Using AccessData FTK to Recover E-mail

1. AccessData FTK can index data on a disk image or an entire drive for faster data retrieval.  FTK also filters and finds files specific to e-mail clients and servers.
2. To recover e-mail from Outlook and Outlook Express, AccessData integrated dtSearch. dtSearch builds a b-tree index of all text data in a drive, an image file or a group of files.
3. See Figures 12-23 through 12-28 to illustrate how to use FTK to recover e-mails.

Using a Hexadecimal Editor to Carve E-mail Messages

1. Very few vendors have products for analyzing e-mail in systems other than Microsoft.
2. The mbox format stores e-mails in flat plaintext files. The Multipurpose Internet Mail Extensions (MIME) format is used by vendor-unique e-mail file systems, such as Microsoft .pst or .ost.
3. See Figures 12-29 through 12-32 to descrie how to carve e-mail messages from Evolution.