Stellar Logo
  • For Individuals
    Back to main menu

    For Individual

    • Windows Data Recovery

      Recovers lost or deleted Office documents, emails, presentations & multimedia files.

      • Free
      • Standard
      • Professional
      • Premium
    • Mac Data Recovery

      Recovers deleted files, photos, videos etc. on Mac.

      • Free
      • Standard
      • Professional
      • Premium
    • Photo Recovery

      Recover photos, videos, & audio files from all cameras and storage on Windows or Mac.

      • Standard
      • Professional
      • Premium
    • iPhone Data Recovery

      Recover deleted photos, videos, contacts, messages etc. directly from iPhone & iPad.

      • Recover
      • Erase
      • Toolkit
    • Video Repair

      Repair multiple corrupt videos in one go. Supports MP4, MOV & other formats.

      • Standard
      • Premium
    • Photo Repair

      Repair multiple corrupt photos in one go. Supports JPEG & other formats.

      • Standard
      • Professional
      • Premium
  • For Business
    Back to main menu

    For Business

    • Email Repair
      • Exchange Repair Repair corrupt EDB file & export mailboxes to Live Exchange or Office 365
      • Outlook PST Repair Repair corrupt PST & recover all mailbox items including deleted emails & contacts
      • OLM Repair Repair Outlook for Mac (OLM) 2011 & 2016 backup files & recover all mailbox items
      • Exchange Toolkit Repair EDB & Exchange backup file to restore mailboxes, convert OST to PST, & convert EDB to PST
      • Active Directory Repair Repair corrupt Active Directory database (Ntds.dit file) & extract all objects in original form
    • Email Converter
      • EDB to PST Convert online & offline EDB file & extract all mailbox items including Public Folders in PST
      • OST to PST Convert inaccessible OST file & extract all mailbox items including deleted emails in PST
      • NSF to PSTConvert IBM Notes NSF file & export all mailbox items including emails & attachments to PST
      • MBOX to PSTConvert MBOX file of Thunderbird, Entourage & other clients, & export mailbox data to PST
      • OLM to PST Convert Outlook for Mac Data File (OLM) & export all mailbox data to PST in original form
      • GroupWise to PST Convert GroupWise mail & export all mailbox items - emails, attachments, etc. - to PST
      • EML to PSTConvert Windows Live Mail (EML) file & export mailbox data - emails, attachments, etc. - to PST
      • Office 365 to PSTConnect to Office 365 account & export mailbox data to PST and various other formats
      • Migrator for Office 365Quickly migrate Outlook data files(OST/PST) directly to Office 365 or Live Exchange
    • File Repair
      • SQL Repair Repair corrupt .mdf & .ndf files and recover all database components in original form
      • Access RepairRepair corrupt .ACCDB and .MDB files & recover all records & objects in a new database
      • QuickBooks RepairRepair corrupt QuickBooks® data file & recover all file components in original form
      • MySQL RepairRepair MyISAM & InnoDB tables and recover all objects - keys, views, tables, triggers, etc.
      • Excel RepairRepair corrupt Excel (.XLS & .XLSX) files and recover tables, charts, chart sheet, etc.
      • BKF RepairRepair corrupt backup (BKF, ZIP, VHDX and .FD) files and restore complete data
      • Database ConverterInterconvert MS SQL, MySQL, SQLite, and SQL Anywhere database files
      • PowerPoint RepairRepair corrupt PPT files and restore tables, header, footer, & charts, etc. like new
      • File Repair ToolkitRepair corrupt Excel, PowerPoint, Word & PDF files & restore data to original form
    • Data Recovery & Erasure
      • Data RecoveryRecover lost or deleted data from HDD, SSD, external USB drive, RAID & more.
      • Tape Data RecoveryRetrives data from all types and capacities of tape drives including LTO 1, LTO 2, LTO 3, & others.
      • Virtual Machine RecoveryRecover documents, multimedia files, and database files from any virtual machine
      • File ErasurePermanently wipe files and folders, and erase traces of apps and Internet activity.
      • Mobile ErasureCertified and permanent data erasure software for iPhones, iPads, & Android devices
      • Drive ErasureCertified and permanent data erasure software for HDD, SSD, & other storage media
    • Toolkit
      • Exchange Toolkit5-in-1 software toolkit to recover Exchange database, convert EDB to PST, convert OST to PST, restore Exchange backup, and reset Windows Server password.
      • Outlook ToolkitComprehensive software suite to repair PST files, merge PST files, eliminate duplicate emails, compact PST files, and recover lost or forgotten Outlook passwords.
      • File Repair ToolkitPowerful file repair utility to fix corrupt Word, PowerPoint, and Excel documents created in Microsoft Office. It also repairs corrupt PDF files and recovers all objects.
      • MS SQL Toolkit5-in-1 software toolkit to repair corrupt SQL database, restore database from corrupt backup, reset database password, analyze SQL logs, & interconvert databases.
      • Data Recovery ToolkitSoftware helps to recovers deleted data from Windows, Mac and Linux storage devices. Also supports recovery from RAIDs & Virtual Drives.
    • Forensic
      • Email ForensicAdvanced email forensic solution for cyber experts to audit, analyze, or investigate emails & gather evidences.
      • Log Analyzer for MySQLAnalyze forensic details of MySQL server database log files such as Redo, General Query, and Binary Log.
      • Exchange AuditorExchange Server monitoring solution to automate audits, scans and generate reports ìn real-time.
      • Log Analyzer for MS SQLTrack & analyze MS SQL Server database transactions log files.
  • Our Partners
  • Lab Services
  • Support
  • About

Trending Searches

Data Recovery

Photo Recovery

Video Repair

iPhone Data Recovery

File Erasure Software

Exchange Repair

OST to PST

PST Repair

Raid Recovery

MS SQL Repair

Email Forensics 4 minute read

Approaches to Filter Emails for eDiscovery and Forensic Investigation

Abhinav Sethi
Written By
Abhinav Sethi
Kuljeet Singh
Approved By
Kuljeet Singh
stellar calander
Updated on
September 2nd, 2022

Contents

  • Method 1: Collecting First, Filtering Later
  • Method 2: Filtering First, Collecting Later 
  • Conclusion

Summary: In this blog, we have discussed two methods to filter emails during email forensics investigation. We have also talked about the advantages and disadvantages of these two approaches. Apart from this, we have also highlighted the utility of using an efficient Email forensics software, like Stellar Email Forensics.

TRY 60 DAYS FREE

When you collect mailboxes for eDiscovery and digital forensics investigation, you need to search and filter the emails and other details. Email filtering helps you save considerable time and costs. In addition, it helps overcome privacy issues that stop collecting certain emails for forensic investigation. 

There are two methods to filter emails during email forensics investigation – Collecting First, Filtering Later, and Filtering First, Collecting Later.

Stellar

Let us take a closer look at both methods and their advantages and disadvantages.

Method 1: Collecting First, Filtering Later

In this approach, forensic investigators start with collecting all the mailboxes. After collecting these mailboxes, they import them into an advanced eDiscovery and email forensics software, such as Stellar Email Forensic. This software comes with a 60-day trial period. The entire software’s features are available in the trial version itself. With an easy-to-use manual available on the website, you can search and filter the relevant emails in a short time and perform subsequent steps, such as processing, reviewing, and generating reports.

Advantages:

The following are some advantages of this method:

  • Sometimes, the requirements and scope of a case change after you start an investigation. You may need to collect additional emails from the mailboxes when this happens. If you already have access to entire mailboxes, you can efficiently perform new or revised searches and collect additional emails.
  • When you filter emails with comprehensive email forensics tools, such as Stellar Email Forensic, you can efficiently perform advanced searches with functions like Boolean Search or Regular Expression Search. Stellar Email Forensic is an advanced eDiscovery and email investigation software that analyzes and investigates mailbox data of various email clients, email services (such as Exchange, Office 365, GroupWise Server, Google Mail, Notes, etc.), and email backup files with 100% accuracy. In other words, it is an advanced software for email search, which supports investigation at the granular level and helps in digital evidence collection. Apart from this, you can also filter attachments based on file types. This way, you can quickly find the relevant data with great accuracy.
  • Stellar Email Forensics generates customized litigation reports; hence it preserves the evidence in a legally acceptable format. The evidence is preserved with MD5 and SHA1 hash values while extracting and analyzing the data.

Disadvantages:

The following are some disadvantages of this method:

  • Collecting entire mailboxes can be cumbersome and time-consuming. If there are several mailboxes, you may end up spending hours collecting all of them.
  • Specific mailboxes may contain sensitive or confidential information you are not authorized to access. Collecting mailboxes entirely, i.e., without filtering confidential emails, may violate certain conditions.

Method 2: Filtering First, Collecting Later 

In this method, you first perform mailbox searches directly using the built-in search functions of email services and products. Email clients, such as Office 365, Gmail, Outlook, etc., provide various search options. Afterward, you can collect emails that are relevant to the forensic investigation.

Advantages:

The following are some advantages of this method:

  • Filtering emails first can save you a lot of time as you can perform searches directly on the mailbox and collect the limited emails you need.
  • Due to privacy concerns, you may have been directed not to collect an entire mailbox. In that case, collecting particular messages sent between specific date ranges and only by certain individuals should be your priority.

Disadvantages:

The following are some disadvantages of this method:

  • If the scope of your investigation expands later, you may again need the mailboxes involved and perform a new or revised search. This is time-consuming and a waste of resources.
  • Search capabilities are limited even in top email services like Gmail and Office 365. You have to use keyword searches, and it isn’t easy to perform advanced searches that are more targeted toward your desired information. So, there is a good chance that you may miss important emails in your search.
  • Search syntax varies from one email service to another. For instance, Gmail’s search syntax differs from the Advanced Query Syntax (AQS) used in Microsoft Exchange Web Services. You need to learn all these different syntaxes and commands to search and filter emails for forensic investigation. Stellar Email Forensic is one tool that helps filter, even from webmail service providers, such as Gmail, Yahoo Mail, Office 365, etc.
Method ProsCons
Method 1: Collecting first, filtering laterPerforming a new search is easy, as you have access to the entire mailboxes. In addition, an Enterprise-grade eDiscovery email forensic tool, such as Stellar Email Forensic, offers advanced search functions that make the searching task very easy.Collecting entire mailboxes is time-consuming. This can create problems when there are privacy concerns or time constraints.
Method 2: Filtering first, collecting laterSaves time during email collection. At the same time, privacy concerns and time constraints can be addressed.Collecting additional emails that exist in source mailboxes requires re-acquisition of the mailboxes, which can further create unnecessary delays in the investigation process. Performing searches in email platforms gives you limited search functions and tools. There is a learning curve with different email platforms, which follow different search syntax and commands.

Conclusion

Filtering and searching emails before or after forensic collection have specific pros and cons. For example, suppose there are privacy concerns or other restrictions while preserving the entire mailboxes. In that case, you may have to perform searches on the original mailboxes first, following the organization’s security protocol. However, if you can collect the entire mailboxes and access the complete database, it is better to collect them first and then perform filtering and searching on those mailboxes.

Need a powerful email forensics software that can easily search and filter emails for forensic investigation? Check out Stellar Email Forensic! It supports more than 25 standard email file formats, such as EDB, PST, OST, DBX, NSF, MBOX, OLM, etc. In addition, it offers deleted email recovery and has a facility for case management during criminal investigations with the support of tagging, bookmarking, and log management. Download it now!

About The Author

Abhinav Sethi

Abhinav Sethi is a Senior Writer at Stellar. He writes articles, blog posts, knowledge-bases, case studies, etc. for different technologies. He also has a keen interest in digital forensics and helps forward-thinking companies fight different threats with apt solutions.

Best Selling Products

Stellar Data Recovery Professional for Windows

Stellar Data Recovery Professional for Windows

Stellar Data Recovery has the right Windows Recovery tool for all your data recovery

Read More
Stellar Data Recovery Professional for Mac

Stellar Data Recovery Professional for Mac

Stellar Data Recovery for Mac program performs safe..

 

Read More
Stellar Photo Recovery

Stellar Photo Recovery

A comprehensive photo recovery software to restore photos, music & video files

 

Read More
Stellar Repair for Video

Stellar Repair for Video

Powerful video repair tool for repairing corrupt or damaged MOV and other video files

 

Read More

Table of Contents    arrow

  1. Method 1: Collecting First, Filtering Later
  2. Method 2: Filtering First, Collecting Later 
  3. Conclusion

Categories

Related Posts

related post
Email Repair

How to Fix the Error ‘Outlook.pst is not Compatible’?

Stellar Author Ravi Singh March 2, 2023 Read More
related post
Email Forensics

How to Prevent Email Spoofing in Gmail?

Stellar Author Nduka John C. February 14, 2023 Read More
related post
Email Repair

How to Repair Corrupt Outlook PST and Import it to Live Exchange?

Stellar Author Eric Simson February 3, 2023 Read More

Free Trial for 60 Days

Technology You Can Trust A Brand Present Across The Globe

  • tuv1
  • tuv2
  • Nist
  • hipa

Stellar Official Website

Stellar Data Recovery Inc.
48 Bridge Street Metuchen,
New Jersey 08840,
United States

ALSO AVAILABLE AT

ALSO AVAILABLE AT

About

  • About us
  • Career
  • ISMS Policy
  • Privacy Policy
  • Terms of Use
  • License Policy
  • Refund Policy
  • End User License Agreement

RESOURCES

  • Blog
  • Articles
  • Product Videos
  • Knowledge Base
  • Case Studies
  • Whitepapers
  • Software Catalog

NEWS & EVENTS

  • News
  • Events

PARTNERS

  • Affiliates
  • Resellers
  • Distributors

Useful Links

  • Contact Us
  • Support
  • Special Offers
  • Student Discounts
  • Awards & Reviews
  • Downloads
  • Store
  • Sitemap

Stellar & Stellar Data Recovery are Registered Trademarks of Stellar Information Technology Pvt. Ltd. © Copyright 2023 Stellar Information Technology Pvt. Ltd. All Trademarks Acknowledged.

Follow Us Facebook Twitter Linkedin Youtube

  • Notron
  • dcma
Subscribe

Subscribe to our newsletter!

Its good time to subscribe and get the latest promtion

With subscribing you agree with our Terms & Conditions

This website uses cookies in order to provide you with the best possible experience and to monitor and improve the performance of the site in accordance with our cookie policy. You can reject cookies at any time in your browser settings.

cookies-cross
Got it