Home page logo

educause logo Educause Security Discussion mailing list archives

Re: E-Discovery of remote PST files
From: "John H. Sawyer" <jsawyer () UFL EDU>
Date: Mon, 8 Dec 2008 19:08:48 -0500

A combination of libpff and F-Response enterprise might work well in
this situation. You could push the F-Response service to all the
machines you need to access, mount their drives read-only remotely via
iSCSI, and read the files using libpff.

I haven't tested the above technique but the F-Response site does have
a video showing access of a live Exchange server's message DB via F-
Response and exmerge. Slightly similar.


On Dec 8, 2008, at 3:19 PM, Dave Koontz <dkoontz () MBC EDU> wrote:

All, our legal counsel are trying to comply with a legal request to
over all email communication campus wide regarding an individual
over the
last couple years.  We do not archive messages, and the vast
majority of our
users pull their email via POP3 to Outlook where those messages are
on their local PC.

Are there any tools you can recommend to remotely scan users PST
files for
specific messages, and hopefully pull those messages out, or foward
them off
to the administrator?

Obviously, we will have to come up with other methods for Mac users
or those
using different email clients, but the vast majority are Outlook
users... so
any help there would be greatly appreciated.  It will take forever
to visit
hundreds of PCs.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]