E-Investigations Develops Custom Computer Forensics Software

E-Investigations, Inc. created a customized computer forensics software program to extract email containers such as Outlook OST, PST and Lotus Notes NSF files from hard drives or data collected for computer forensic analysis during discovery or initial investigation.

A Personal Storage Table (PST) is an open, proprietary file format used to store messages, calendar events, and other items within Microsoft software such as Exchange Client, Windows Messaging, and Outlook. When functioning in its capacity as a cache for Outlook’s Cached Exchange Mode feature, it may be called an Offline Storage Table (.ost) or an Offline Folder File.

Lotus Notes also has their own Notes Storage Facility (NSF) files, which are the standard container for data in the Notes architecture, for its storage.

In computer forensic investigations, it is common to have examiners look for email. Typically this involves searching the hard drives, digital media, servers and other files for e-mail containers. Most computers are configured to save email in container files or storage tables which act as email databases on the local computer so the email can be quickly accessed from the computer without the bottleneck of an internet connection. The most common type of e-mail container is from Outlook. One Outlook file can contain tens of thousands of individual email messages. Current computer forensics searching techniques involves searching these containers. While this method works, it is more time consuming and not as flexible as searching individual email messages. Existing software to break apart e-mail containers are typically very labor intensive and/or very expensive. The new custom computer forensics and software created by E-Investigations automates this process to make it quick, accurate, and affordable.

E-Investigation’s program can search multiple partitions on multiple hard drives within a single case, export the email containers, and extract individual emails from the containers in a single step. Once the individual messages have been exported, the messages are then ready for further processing by de-duplication, indexing, searching, or the analysis of headers, attachments, or message text. The program includes several methods of error checking and quality control. This process allows E-Investigations to provide more accurate results to its clients in less time and at a lower cost. It also prepares the email for quick and easy import into litigation review programs such as Summation, Concordance and iConnect.

"This computer forensics software has really cut down on our processing time, which allows our clients to receive their data faster and reduces overall costs for the project. E-Investigations is really proud to have developed such powerful and useful investigation tool," remarked Gary Huestis, director of Digital Forensic, with E-Investigations.

E-Investigations has the tools and experience to perform logical, physical, file system and password extraction of data from digital devices. By the incorporating the latest hardware and software technologies, it has thorough capabilities for computer and mobile device investigations – with the ability to image thousands of computers, tablets, mobile phones, smartphones and portable GPS devices, and all major mobile OS: iOS, Android, BlackBerry, Nokia, Symbian, Windows Mobile and Palm.

E-Investigation’s Computer Forensic Investigators follow the trail and decipher the information regardless of whether the evidence is digital, such as electronically stored information found on computers, tablets, mobile phones or other devices or if the investigation requires traditional private investigative services. Tools and techniques include surveillance, undercover work and detailed record searches. The final product helps clients gain a deeper understanding of what has happened or what is occurring. The gained clarity and discovery of truth allows our clients to respond and recover.