20. Search: Email

• This search locates Client-Based Email, resulting from using email applications installed.

• To begin, click the Search button.

• Select Search fot email and select all available email sub-types.

• (Additionally, you can also checkmark Search for Internet History.)

• Click Start.

• The results of the search are located under

  • Cases -> Records -> Home in the Tree view.

• Outlook express stores individual emails and email attachments in DBX files on the client's machine.

• DBX files are compount files, so they can be mounted via View File Structure option available on the short-cut menu.

• In the Records subtab, the Report view will display email headers, the message, and attachments.

• See EnCase student's guide, Lesson 31, for details on Bookmarking emails and attachments.