Jump to content

Priv1.edb file


fuzed
 Share

Recommended Posts

The client has given us a set of keywords to search for as they have had no success finding the records of interest.

 

I've conducted a search for an email address using EnCase and have had hits within the priv1.edb file for the records.

 

The same can not be said for the same data within Intella, the same data has been processed, but when I search for the email address we are not seeing the same results.

 

Is Intella not parsing data correctly, is it not showing raw data possibly? 

Link to comment
Share on other sites

Hi Fuzed,

 

It's really hard to know what is happening here. Are the email items missing completely or is it just metadata that is missing in Intella.

 

Perhaps create a proper ticket via our support portal so that you can send us the logs etc.

 

Regards

 

Jon

Link to comment
Share on other sites

It's also worth trying to extract the mail boxes to PST from the EDB with something like Systools or Kernel for exchange, then indexing the PST's within Intella.

 

I haven't tried parsing any EDB files with 1.9.1 yet as I know they have improved support for EDB, but historically it was problematic.

Link to comment
Share on other sites

 Share

×
×
  • Create New...