fuzed Posted April 12, 2016 Report Posted April 12, 2016 The client has given us a set of keywords to search for as they have had no success finding the records of interest. I've conducted a search for an email address using EnCase and have had hits within the priv1.edb file for the records. The same can not be said for the same data within Intella, the same data has been processed, but when I search for the email address we are not seeing the same results. Is Intella not parsing data correctly, is it not showing raw data possibly?
jon.pearse Posted April 13, 2016 Report Posted April 13, 2016 Hi Fuzed, It's really hard to know what is happening here. Are the email items missing completely or is it just metadata that is missing in Intella. Perhaps create a proper ticket via our support portal so that you can send us the logs etc. Regards Jon
AdamS Posted April 14, 2016 Report Posted April 14, 2016 It's also worth trying to extract the mail boxes to PST from the EDB with something like Systools or Kernel for exchange, then indexing the PST's within Intella. I haven't tried parsing any EDB files with 1.9.1 yet as I know they have improved support for EDB, but historically it was problematic.
fuzed Posted April 15, 2016 Author Report Posted April 15, 2016 thanks, guys, my thinking as well, we purchased the kernel software a few years ago, shall look into parsing the edb/stm files using that.
Recommended Posts