fuzed Posted April 12, 2016 Report Share Posted April 12, 2016 The client has given us a set of keywords to search for as they have had no success finding the records of interest. I've conducted a search for an email address using EnCase and have had hits within the priv1.edb file for the records. The same can not be said for the same data within Intella, the same data has been processed, but when I search for the email address we are not seeing the same results. Is Intella not parsing data correctly, is it not showing raw data possibly? Quote Link to comment Share on other sites More sharing options...
jon.pearse Posted April 13, 2016 Report Share Posted April 13, 2016 Hi Fuzed, It's really hard to know what is happening here. Are the email items missing completely or is it just metadata that is missing in Intella. Perhaps create a proper ticket via our support portal so that you can send us the logs etc. Regards Jon Quote Link to comment Share on other sites More sharing options...
AdamS Posted April 14, 2016 Report Share Posted April 14, 2016 It's also worth trying to extract the mail boxes to PST from the EDB with something like Systools or Kernel for exchange, then indexing the PST's within Intella. I haven't tried parsing any EDB files with 1.9.1 yet as I know they have improved support for EDB, but historically it was problematic. Quote Link to comment Share on other sites More sharing options...
fuzed Posted April 15, 2016 Author Report Share Posted April 15, 2016 thanks, guys, my thinking as well, we purchased the kernel software a few years ago, shall look into parsing the edb/stm files using that. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.