Forensic Email Collector v3.70 Release Notes

Hello, everyone!

We have released FEC v3.70 today :rocket:

I will cover a few exciting features the new update introduces:

Differential Acquisitions

FEC can now scan a folder containing past acquisitions and exclude messages from the current acquisition when the same messages were successfully acquired in previous acquisitions of the same mailbox. Differential acquisitions make a few use cases possible:

Change in Project Specifications

If the search specifications change after an in-place search was performed, you can use a differential acquisition to capture any additional items responsive to the revised search.

Periodic, Incremental Acquisitions

In some cases, it may be desirable to set up periodic, incremental acquisitions to support an ongoing disclosure obligation. If you create new differential acquisitions within the same main folder periodically (for instance, by creating a template acquisition project and re-using it with a script), each new acquisition would scan back to what was previously acquired and only acquire what was not.

Supplemental Acquisitions

You can run a narrow in-place search to acquire the emails that are most likely to be relevant and get started with the examination/review/production right away. Differential acquisitions can be used to supplement this initial, narrow acquisition with larger acquisitions—either with a broader range of terms or complete mailbox acquisitions.

Storage Quota Report

Along with your Gmail / Google Workspace acquisition, it is now possible to generate a storage quota report for the target mailbox. This is helpful in scenarios where the end-user claims that they deleted emails because they were running out of storage space in their Google account. The storage quota report can help verify whether such a claim is likely to be truthful without having to obtain full access to the end-user’s Google account.

Additional Metadata from Google Calendar and Drive

We have extended the metadata FEC acquires from Google Calendar and Drive to include the user’s access role for each calendar and permissions for each Drive file, where available.

This version contains quite a few other performance and user interface improvements. You can find the changelog here.

I am personally most excited about differential acquisitions—they make life so much easier. :smiley:

We have added/updated the following support articles in connection with this release:

:link: Differential Acquisitions