GSuite extract emails and save copy of mbox as Admin without knowing users password?

GSuite extract emails and save copy of mbox as Admin without knowing users password?

Is it possible?

You can do this with FEC using domain-wide delegation. That said, the output would be in EML, MSG, and PST formats rather than mbox.

If you must have mbox output, and if the G Suite organization is on a plan with Vault, you can use Vault to export in mbox format. We have a writeup on the cons and pros of each method here: https://www.metaspike.com/google-takeout-vault-email-forensics/

1 Like

so with [domain-wide delegation] I will be able to collect 30 PST for each user?

If you have 30 users in the organization, you can authenticate using a service account and collect each mailbox as a PST.

you can authenticate using a service account and collect each mailbox as a PST. - please explain more detail…

Figure it out. FEC ROCKS!!!

Great! Just in case, we have a video walkthrough here—delegation discussion starts around 43:30.

1 Like

If we have access to a service account, is there a way to automate exports for a large number of mailboxes via this method e.g. input csv with target mailboxes?

Yes! Once you set up domain-wide delegation, you can add a list of mailboxes as additional targets and batch-create their acquisition projects. You can then start/resume those using the supplied batch file, or split them up and run them on multiple computers in parallel.

We have some more info on this here:

This also applies to regular acquisitions without delegation (e.g., Yahoo). In that case, you would need to include passwords for each additional target in your target list file.

We also have a quick walkthrough of this in the last webinar recording here (minute 43):