Email Server Forensics
- If messages are deleted on a mail client, can often still be available on an email server
- email servers often have retention policies
- common email server software extensions:
- Exchange Server (
.edb) - Exchange Public Folders (
pub.edb) - Exchange Private Folders (
priv.edb) - Streaming Data (
priv.stm) - Lotus Notes (
nsf) - GroupWise (
.db) - GroupWise Post Office Database (
wphost.db) - GroupWise User Databases (
userxxx.db) - Linux Email Server Logs (
/var/log/mail.*)
- Exchange Server (