Encase Enterprise

Posted on 2010-01-11
Medium Priority
Last Modified: 2012-05-08
Does anyone know, of those who have experience with Encase Enterprise, if the encase servlet has to be installed on the Exchange server, or Symantec's Vault, to allow email to be searched?
Question by:sunny10
LVL 66

Expert Comment

ID: 26301210
The forum be useful to find the answer - Exchange is highly likely as it can search EDB format
@ https://support.guidancesoftware.com/

Accepted Solution

Mr_Fulano earned 200 total points
ID: 31077517
Sunny10, that depends on what email file you want to search. The Servlet has to be installed on any device to make a connection via the EE SAFE from your forensic workstation. Once the connection is made, the Servlet plays no real role.

Now, going back to your question. If you want to review email files on the Exchange server itself - then the answer is Yes. The only way to get to that server is by way of the Servlet. If you want to review emails in a local copy of an OST file on a workstation, then the answer is No...you don't need to install the Servlet on the Exchange server, but rather it does need to be installed on the WS you're going to access.

Also, keep in mind, most email files, like OSTs are compressed database files, so you'll have to "view the file structure" to actually get to the emails.

The simplest way to review email from the Exchange server is to have the Exchange Admin make you a PST copy of the specific email file you need and then review it on your forensic WS. Don't mess with a production server, especially in a big organization. You don't want to be the guy that brought down email for XYZ Corp.

Hope that points you in the right direction.


Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this era, as you know, cybercrime and other sorts of frauds using the internet has increased day by day. We should protect our information assets and confidential information from getting exploiting by the attacker or intruders. Most of the fraud…
It all started with a phone call.  The then acting director of the Office of Research Computing, called to ask me to remotely shutdown my computer, it was Yom Kippur, Wednesday October 12, 2016.
Integration Management Part 2
As many of you are aware about Scanpst.exe utility which is owned by Microsoft itself to repair inaccessible or damaged PST files, but the question is do you really think Scanpst.exe is capable to repair all sorts of PST related corruption issues?
Suggested Courses
Course of the Month9 days, 1 hour left to enroll

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question