Forum Discussion

Denis_Methot's avatar
Denis_Methot
Level 4
14 years ago

Using eDiscovery to search on Internet Mail Header

We just purchase eDiscovery and one thing that would be nice to be able to do is to search on Internet Headers, like for potentially IP addresse. Does anyone know if its possible and if it is how to go about in doing the search.

Thx

Discovery Accelerator
Information Governance
Tip-How to
Training
  • Liam_Finn1's avatar
    Liam_Finn1
    14 years ago

    I do not believe that the IP address in the header is indexed so searching for IP will not work as far as i know.

     

    EV dies index the header but not all data in the header. Stuff like from, to, cc, bcc, date, time, and so on.

  • Liam_Finn1's avatar
    Liam_Finn1
    Level 6
    14 years ago

    I do not believe that the IP address in the header is indexed so searching for IP will not work as far as i know.

     

    EV dies index the header but not all data in the header. Stuff like from, to, cc, bcc, date, time, and so on.

  • Bailine's avatar
    Bailine
    14 years ago

    Traditionally, analysis of extended header information present on email has been a Forensics use case.  However, as the lines between Forensics and pure eDiscovery are blurred we see Forensics creep into eDiscovery and vice versa.

    Clearwell - Now Part of Symantec offers full extended header viewing capabilities.  During processing Clearwelly globally de-duplicates all ESI within the corpus.  Despite having access to search and review a single copy of an email, in this case, the reviewer has full access to every duplicate's extended header information.

    In the attached example our reviewer has access to extended header information for the three copies of our email in a pop-up like view.

    Thanks.

    Bret Bailine

    Sr. Manager, Systems Engineering

    US Federal Government

    www.symantec.com/clearwell