?
Solved

Encase Enterprise

Posted on 2010-01-11
2
Medium Priority
?
1,447 Views
Last Modified: 2012-05-08
Does anyone know, of those who have experience with Encase Enterprise, if the encase servlet has to be installed on the Exchange server, or Symantec's Vault, to allow email to be searched?
0
Comment
Question by:sunny10
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 64

Expert Comment

by:btan
ID: 26301210
The forum be useful to find the answer - Exchange is highly likely as it can search EDB format
@ https://support.guidancesoftware.com/
0
 

Accepted Solution

by:
Mr_Fulano earned 200 total points
ID: 31077517
Sunny10, that depends on what email file you want to search. The Servlet has to be installed on any device to make a connection via the EE SAFE from your forensic workstation. Once the connection is made, the Servlet plays no real role.

Now, going back to your question. If you want to review email files on the Exchange server itself - then the answer is Yes. The only way to get to that server is by way of the Servlet. If you want to review emails in a local copy of an OST file on a workstation, then the answer is No...you don't need to install the Servlet on the Exchange server, but rather it does need to be installed on the WS you're going to access.

Also, keep in mind, most email files, like OSTs are compressed database files, so you'll have to "view the file structure" to actually get to the emails.

The simplest way to review email from the Exchange server is to have the Exchange Admin make you a PST copy of the specific email file you need and then review it on your forensic WS. Don't mess with a production server, especially in a big organization. You don't want to be the guy that brought down email for XYZ Corp.

Hope that points you in the right direction.

Fulano
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The foremost challenge encountered by an investigator at the very beginning of a forensics investigation is, accessing a file/data to read/view its contents. Owing to the fact, a platform is necessary for both; opening as well as examining any file.…
In this era, as you know, cybercrime and other sorts of frauds using the internet has increased day by day. We should protect our information assets and confidential information from getting exploiting by the attacker or intruders. Most of the fraud…
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…
In this video, Percona Solution Engineer Dimitri Vanoverbeke discusses why you want to use at least three nodes in a database cluster. To discuss how Percona Consulting can help with your design and architecture needs for your database and infras…
Suggested Courses

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question