You probably recall from our discussions regarding the EnCase Evidence Processor (EEP) that it processes email as one of it feature sets. In this section, I’ll first review the EEP email-processing options. Next, I’ll cover how to examine the results of the email processor and bookmark those results into your report. The EnCase Evidence Processor has a Find Email module that will currently process the following email types:
To run the Find Email module, simply launch EEP, check the Find Email feature, and choose which email types you want to find, as shown in Figure 10-44.