Email review and mailbox analysis
We read mailbox exports forensically, remove duplicates and make every message and attachment searchable. What matters comes back to you as a PST archive with all metadata.
- as well as MSG and EML are read directly
- PST, OST
- are extracted and searched like documents of their own
- Attachments
- Duplicates across mailboxes are reviewed a single time
- Once
- Tagged messages with sender, recipients and timestamps
- PST export
The answer is usually in an email.
But in which of hundreds of thousands?In almost every investigation, email is the most important source. It shows who knew what and when, who informed whom and where a decision was made. It is also the most confusing source: a single mailbox quickly holds tens of thousands of messages, and with several custodians the same email sits in every mailbox again.
Simply opening Outlook files soon hits limits. Search does not cover scanned attachments, filters by participant across several mailboxes are missing, and every forward shows up as a new hit. On top of that, opening a file in an ordinary mail client can change read status and metadata.
For a sound email review we process the mailboxes forensically and merge them into one index. Your team then searches across all mailboxes at once in Inspector. If chats, file shares or audio come on top of the email, it becomes a full eDiscovery.
How mailboxes become a result list.
Tools for working with email.- 01
All mailboxes in one search
Exports from several people end up in one index. One search finds a term in every mailbox at once, instead of someone opening each of them separately.
- 02
Participants and periods
Filters for sender, recipient, number of participants and date range narrow down which correspondence is relevant at all. The timeline shows clusters on individual days.
- 03
Attachments as documents
Attached files are extracted, and scanned attachments are made readable through OCR. A draft contract in an attachment can be found just like the text of the email.
- 04
Duplicates merged
The same message in five mailboxes is one object, not five hits. That reduces the number of emails anyone actually has to read.
- 05
Precise search syntax
Exact phrases, excluded terms and full text can be combined. That way you separate, for example, a project name from an everyday word that sounds the same.
- 06
Export as PST archive
Tagged messages leave the collection as a PST file with sender, recipients, timestamps and attachments. Outlook opens it directly, and third parties receive exactly the selected emails.
One search, 47 hits.
Out of 1,731,310 objects in the sample case CASE-JKL1.Searching for “Interconnect” narrows the collection down to 47 messages. The hit list with sender, recipient and date is on the left, the opened message in full text on the right.
- 01
Filters above the list
Period, attachments and number of participants narrow the hits down further.
- 02
Hits in context
The first email, dated 12 June 2004, mentions a difference of about €4,200 in the billed volumes.
- 03
Attachment included
The breakdown per interconnect point is attached to the email and is a searchable document itself.
%20--%3e%3csvg%20version='1.1'%20id='Ebene_2'%20xmlns='http://www.w3.org/2000/svg'%20x='0px'%20y='0px'%20viewBox='0%200%20595.3%20841.9'%20style='enable-background:new%200%200%20595.3%20841.9;'%20xml:space='preserve'%3e%3cstyle%20type='text/css'%3e%20.st0{fill:%231A5DED;}%20.st1{fill:%23FFFFFF;}%20%3c/style%3e%3cpolygon%20class='st0'%20points='325.9,255.1%20265.9,255.1%20235.9,307%20265.9,359%20325.9,359%20355.9,307%20'/%3e%3cpolygon%20class='st1'%20points='325.9,141.1%20265.9,141.1%20235.9,193.1%20265.9,245.1%20325.9,245.1%20355.9,193.1%20'/%3e%3cpolygon%20class='st1'%20points='325.9,596.8%20265.9,596.8%20235.9,648.8%20265.9,700.8%20325.9,700.8%20355.9,648.8%20'/%3e%3cpolygon%20class='st1'%20points='325.9,482.9%20265.9,482.9%20235.9,534.9%20265.9,586.8%20325.9,586.8%20355.9,534.9%20'/%3e%3cpolygon%20class='st0'%20points='325.9,369%20265.9,369%20235.9,420.9%20265.9,472.9%20325.9,472.9%20355.9,420.9%20'/%3e%3cpolygon%20class='st1'%20points='325.9,710.8%20265.9,710.8%20235.9,762.7%20265.9,814.7%20325.9,814.7%20355.9,762.7%20'/%3e%3cpolygon%20class='st0'%20points='424.1,198.1%20364.1,198.1%20334.1,250.1%20364.1,302%20424.1,302%20454.1,250.1%20'/%3e%3cpolygon%20class='st1'%20points='424.1,84.2%20364.1,84.2%20334.1,136.1%20364.1,188.1%20424.1,188.1%20454.1,136.1%20'/%3e%3cpolygon%20class='st1'%20points='424.1,539.9%20364.1,539.9%20334.1,591.8%20364.1,643.8%20424.1,643.8%20454.1,591.8%20'/%3e%3cpolygon%20class='st1'%20points='424.1,425.9%20364.1,425.9%20334.1,477.9%20364.1,529.9%20424.1,529.9%20454.1,477.9%20'/%3e%3cpolygon%20class='st1'%20points='424.1,312%20364.1,312%20334.1,364%20364.1,415.9%20424.1,415.9%20454.1,364%20'/%3e%3cpolygon%20class='st1'%20points='424.1,653.8%20364.1,653.8%20334.1,705.8%20364.1,757.7%20424.1,757.7%20454.1,705.8%20'/%3e%3cpolygon%20class='st0'%20points='522.4,141.1%20462.4,141.1%20432.4,193.1%20462.4,245.1%20522.4,245.1%20552.4,193.1%20'/%3e%3cpolygon%20class='st1'%20points='522.4,27.2%20462.4,27.2%20432.4,79.2%20462.4,131.1%20522.4,131.1%20552.4,79.2%20'/%3e%3cpolygon%20class='st1'%20points='522.4,482.9%20462.4,482.9%20432.4,534.9%20462.4,586.8%20522.4,586.8%20552.4,534.9%20'/%3e%3cpolygon%20class='st1'%20points='522.4,369%20462.4,369%20432.4,420.9%20462.4,472.9%20522.4,472.9%20552.4,420.9%20'/%3e%3cpolygon%20class='st1'%20points='522.4,255.1%20462.4,255.1%20432.4,307%20462.4,359%20522.4,359%20552.4,307%20'/%3e%3cpolygon%20class='st1'%20points='522.4,596.8%20462.4,596.8%20432.4,648.8%20462.4,700.8%20522.4,700.8%20552.4,648.8%20'/%3e%3cpolygon%20class='st0'%20points='167.3,643.8%20227.3,643.8%20257.3,591.8%20227.3,539.9%20167.3,539.9%20137.3,591.8%20'/%3e%3cpolygon%20class='st1'%20points='167.3,757.7%20227.3,757.7%20257.3,705.8%20227.3,653.8%20167.3,653.8%20137.3,705.8%20'/%3e%3cpolygon%20class='st1'%20points='167.3,302%20227.3,302%20257.3,250.1%20227.3,198.1%20167.3,198.1%20137.3,250.1%20'/%3e%3cpolygon%20class='st1'%20points='167.3,415.9%20227.3,415.9%20257.3,364%20227.3,312%20167.3,312%20137.3,364%20'/%3e%3cpolygon%20class='st0'%20points='167.3,529.9%20227.3,529.9%20257.3,477.9%20227.3,425.9%20167.3,425.9%20137.3,477.9%20'/%3e%3cpolygon%20class='st0'%20points='68.9,700.8%20128.9,700.8%20158.9,648.8%20128.9,596.8%2068.9,596.8%2038.9,648.8%20'/%3e%3cpolygon%20class='st1'%20points='68.9,359%20128.9,359%20158.9,307%20128.9,255.1%2068.9,255.1%2038.9,307%20'/%3e%3cpolygon%20class='st1'%20points='68.9,472.9%20128.9,472.9%20158.9,420.9%20128.9,369%2068.9,369%2038.9,420.9%20'/%3e%3cpolygon%20class='st1'%20points='68.9,586.8%20128.9,586.8%20158.9,534.9%20128.9,482.9%2068.9,482.9%2038.9,534.9%20'/%3e%3c/svg%3e)
How an email review runs.
From the export file to the result.- 01
Provide the mailboxes
You deliver exports as PST, OST, MSG or EML, or forensic images from which we extract the mailboxes ourselves. Every file gets a hash at handover.
- 02
Processing
We unpack the mailboxes, extract attachments, recognise text in scans and merge duplicates. Sender, recipients, timestamps and folder structure stay unchanged.
- 03
Search and tagging
In Inspector your team narrows down by people, periods and terms, and tags findings as relevant, for review or as privileged. Several reviewers can work in parallel.
- 04
Result and handover
You export relevant messages as a PST archive and summarised findings as a report with source references. Emails tagged as privileged stay out.
The result of an email review.
Usable in the case file, in expert opinions and for clients.The outcome is not a loose pile of hits but a documented set of messages whose origin can be proven at any time.
- Index
- All mailboxes in one collectionDeduplicated, with attachments and preserved metadata.
- PST archive
- Tagged emailsIncluding sender, recipients, timestamps and attachments.
- Report
- Findings with sourcesFor the case file or as the basis of a statement.
- Tags
- Relevant, for review, privilegedTraceable who tagged which email and when.
- Hashes
- At handover and exportProve that the messages have remained unchanged.
What sets this email review apart.
Compared with searching in a mail client.- 01
Forensic, not just opened
Mailboxes are read from copies and never opened in a mail client. Read status, folders and metadata stay exactly as they were when the data was secured.
- 02
Across mailbox boundaries
Correspondence between several people adds up to one picture. Who wrote to whom and when can be followed without switching between individual files.
- 03
Questions in your own words
Besides the search syntax there is AI mode. It answers questions such as when two people were first in touch and names the emails it relies on.
Questions about email review.
Formats, attachments, data protection.Your question is not listed? Write to us.
Outlook data files as PST and OST, individual messages as MSG or EML, and mailboxes contained in forensic images in E01 or AD1. We are happy to check other export formats in advance.
Attachments are extracted from every message and indexed as documents of their own, and scanned attachments are also made readable through OCR. Inspector still shows which email an attachment belongs to.
Yes. Date range, sender, recipient and number of participants can be set as filters, also in combination. That way you only review what matters for the question, not the whole mailbox.
Mailboxes are processed exclusively in Germany, and access is granted per case and logged. As the client you decide which mailboxes and periods are reviewed, ideally in agreement with your data protection officer.
All mailboxes of a case go into the same index, whether there are two or several dozen. With a very large number of custodians we plan processing and review access with you in advance.
More than email.
When the case has other sources too.Got a case on your desk?
Describe data volume, sources and deadline. Within one business day you get an assessment of process and effort.The people behind Explorer, Inspector and Tracer. Your enquiry goes straight to us in Bad Soden am Taunus.
