FAQ

What is Forensic Email Collector?

Forensic Email Collector (FEC) is a desktop application that connects to email servers and forensically preserves mailboxes.

What Makes FEC Better Than Others?

FEC is a dedicated forensic email acquisition tool. It does one thing, and it does it quite well. Because our focus is entirely on forensically preserving mailboxes, we were able to add many unique features to FEC such as:

• Gmail API, Exchange Web Services (EWS), Graph API, IMAP, and POP3 support in one tool.
• Ability to authenticate using OAuth.
• Support for Google Drive attachments and revisions.
• Filtering of mailboxes before acquisition via In-place Search.
• Remote authentication by custodians using FEC Remote Authenticator.
• Detailed acquisition and exception reports.
• Ability to keep track of downloaded and remaining messages, and resume previous acquisition sessions.
• Automatic retries to make sure you can acquire that tough mailbox comfortably.
• Flexible output options that work with virtually any eDiscovery and digital forensics platform.
• Many built-in connection profiles make your life easier.
• Automatic detection of server settings using MX lookups and Exchange Autodiscover.

What Server Types Are Supported?

Forensic Email Collector supports five main groups of servers:

• Gmail API: Using Gmail API, FEC can forensically acquire emails from Gmail and G Suite mailboxes.
• Exchange Web Services (EWS): FEC can connect to Exchange servers and Office 365 using EWS.
• Graph API: FEC can connect to Office 365 and Microsoft’s consumer mailboxes (e.g., Hotmail, Outlook.com) using Graph API.
• IMAP: Hosted email providers such as Yahoo, Hotmail, AOL, Zoho and many others are supported via IMAP.
• POP3: Legacy POP3 servers are also supported when no other connectivity option is available.

What Are The System Requirements?

FEC requires the following:

• PC running Windows 7 SP-1, 8.1, 10, or 11
• .NET Framework v4.7.2
• Modern web browser for OAuth authentication
• Internet connectivity to connect to target email servers and to activate your FEC license

What Happens If I Don’t Know The Server Settings?

Once you enter the target email address, FEC tries to automatically determine the target server settings for you by performing Mail Exchanger (MX) lookups and by using Exchange Autodiscover.

In our experience, you won’t have to enter server settings—such as server address, port, and protocol—into FEC the majority of the time.

Can I Filter Emails before Forensic Collection?

Yes! FEC’s In-place Search allows you to run queries on mailboxes before forensic preservation. These queries run on the server side, and allow you to search emails without having to download them. Saves you a ton of time!

Can FEC Handle Two-Factor-Authentication?

FEC Remote Authenticator is a simple, independent application you can send to a custodian so that they can authenticate FEC to their Gmail, G Suite, or Office 365 account on their own computer. This workflow supports two-factor authentication and does not require the custodian to provide their password to FEC or to you.

When the forensic acquisition is complete, the custodian can go to their account security settings and revoke access to FEC.

Is There A Limit to The Number of Accounts/Messages I Can Collect?

None. You can forensically collect as many mailboxes, and as many email messages as you wish.

What Output Formats Are Supported?

FEC can output to MIME (EML), MSG, and PST formats—simultaneously.

What is Forensic Email Intelligence?

Forensic Email Intelligence (FEI) is a deep dive email investigation and intelligence tool. It can be used to analyze individual messages or scan and score numerous messages from various sources.

FEI is typically used to investigate email fraud, business email compromise, phishing, malware delivery via email, and CAN-SPAM Act violations.

What Email Types Are Supported?

FEI supports EML, MSG, Mbox, OST, and PST files. It can also directly import FEC projects to enable investigating server metadata that FEC captures during forensic preservation.

What Are The System Requirements?

FEI requires the following:

• PC running 64-bit Windows such as Windows 7 SP1, 8, 10, or 11
• .NET Desktop Runtime 6
• Internet connectivity to connect to enrichment APIs and to activate your FEI license