Forensic Email Collector (FEC) is a desktop application that connects to email servers and forensically preserves mailboxes.
Quick Answers to Your Questions
FEC is a dedicated forensic email acquisition tool. It does one thing, and it does it quite well. Because our focus is entirely on forensically preserving mailboxes, we were able to add many unique features to FEC such as:
- Gmail API, Exchange Web Services (EWS), Graph API, IMAP, and POP3 support in one tool.
- Ability to authenticate using OAuth.
- Support for Google Drive attachments and revisions.
- Filtering of mailboxes before acquisition via In-place Search.
- Remote authentication by custodians using FEC Remote Authenticator.
- Detailed acquisition and exception reports.
- Ability to keep track of downloaded and remaining messages, and resume previous acquisition sessions.
- Automatic retries to make sure you can acquire that tough mailbox comfortably.
- Flexible output options that work with virtually any eDiscovery and digital forensics platform.
- Many built-in connection profiles make your life easier.
- Automatic detection of server settings using MX lookups and Exchange Autodiscover.
Forensic Email Collector supports five main groups of servers:
- Gmail API: Using Gmail API, FEC can forensically acquire emails from Gmail and G Suite mailboxes.
- Exchange Web Services (EWS): FEC can connect to Exchange servers and Office 365 using EWS.
- Graph API: FEC can connect to Office 365 and Microsoft’s consumer mailboxes (e.g., Hotmail, Outlook.com) using Graph API.
- IMAP: Hosted email providers such as Yahoo, Hotmail, AOL, Zoho and many others are supported via IMAP.
- POP3: Legacy POP3 servers are also supported when no other connectivity option is available.
FEC requires the following:
- PC running Windows 7 SP-1, 8 or 10
- .NET Framework v4.6.1
- Modern web browser for OAuth authentication
- Internet connectivity to connect to target email servers and to activate your FEC license
Once you enter the target email address, FEC tries to automatically determine the target server settings for you by performing Mail Exchanger (MX) lookups and by using Exchange Autodiscover.
In our experience, you won’t have to enter server settings—such as server address, port, and protocol—into FEC majority of the time.
Yes! FEC’s In-place Search allows you to run queries on mailboxes before forensic preservation. These queries run on the server side, and allow you to search emails without having to download them. Saves you a ton of time!
FEC Remote Authenticator is a simple, independent application you can send to a custodian so that they can authenticate FEC to their Gmail, G Suite, or Office 365 account on their own computer. This workflow supports two-factor authentication and does not require the custodian to provide their password to FEC or to you.
When the forensic acquisition is complete, the custodian can go to their account security settings and revoke access to FEC.
None. You can forensically collect as many mailboxes, and as many email messages as you wish.
FEC can output to MIME (EML), MSG and PST formats—simultaneously.
When you purchase a license of FEC, you receive a perpetual license. Your license key is delivered electronically, so you can start using FEC immediately after we process your order.
Your FEC license also includes software updates and technical support for one year. After one year, you can continue to use FEC without paying a dime. If you would like to receive software updates, you can renew your maintenance for an additional year at 30% of the full price of an FEC license.
If you prefer to have your FEC license on a hardware dongle, you can purchase the FEC Dongle Add-on during checkout. When you do, we still email you a temporary license key—so that you can start to use the software immediately—and also ship you a USB hardware dongle. Your temporary license key is deactivated once you receive your dongle.
The hardware dongle allows you to install FEC on multiple computers, and move your license around simply by plugging and unplugging the dongle. We use a “driverless” dongle, so you do not have to install additional system drivers.
We use Stripe and PayPal for payment processing. You can pay with a credit or debit card, or any other payment method attached to your PayPal account.
We stand behind our product. If you are not thrilled, you can request a refund within 30 days of your purchase. No questions asked.
If you purchased the hardware dongle add-on, you must return the dongle so that we can process your refund request.