Exporting Indexed Email Issues

[rohan.r.patil@gmail.com]

Hi,

The current version of OSForensics is 6.0. Have successfully performed the indexing and also the search index is showing me the output (I am have outlook pst files which were indexed).

The search index displays the output of the keywords which are searched and even the HTML report is exported correctly. But, i need help in the following issues:

1. When viewing the mail with the Internal viewer I get an error saying "the mail may be damaged or trying closing the external program". I am not able to view the mail within the internal viewer. While the same is being displayed on Search Index. How do i see the mail & export it for further analysis.

2. When exporting the mail, the entire PST is getting saved instead of just the 2-3 mails which are the artifacts.

3. When trying alternative methods such as opening the PST file in Outlook and exporting the mails. The mails in the question which are showed up in Search Index are not present even after doing a search in Outlook. I am not able to find the mails in Outlook which are showcased by OSF Search Index.


Kindly share inputs and support.


Regards,
Rohan

[David (PassMark)]

Is this a physical disk, or a disk image? When you added the disk (or image) to the Case in OSF, how did you add it?

Because if the disk (or disk image) gets given a drive letter in Windows, then likely the search function in Windows will start indexing the PST file. Which may result in the file being locked. Item 2) should be fixed if you can solve item 1). Item 3) is more of a problem with Outlook than our software. Are you sure the Emails in question are not deleted, and that you are looking at the correct PST file.