SysTools Office 365 Forensics Tool

Evidence Loading

The software makes it easy for users to add load their digital evidence which is Office 365 email files. This is the first stage of Office 365 forensic investigation in which this software provides plenty of options to users.

• Case Creation - Easy management of cases is the major highlight here as users can create single or multiple cases as per their specific requirements.
• File Scanning - Options like log unprocessed items, logs at case path, uploading attachments while scanning, etc make file scanning more convenient.
• Hash Settings - MD5, SHA1, and SHA256 are the three hash settings that this Office 365 forensics tool offers to forensics investigators.

Evidence Preview

Previewing is the second stage after loading the files for Office 365 forensic investigation of emails. Multiple preview options make it the best tool so far. Viewing data from different perspectives is now easier for users.

• Preview Options - Preview emails, calendars, chat, calls, loose files, and SMS with properties, messages, message header, RTF, HEX, MIME, and HTML views.
• Attachments Preview - There is no barrier for users to preview the attachments in the Office 365 emails that might contain crucial evidence.
• Custom Columns - Selecting or Deselecting columns as per the specific needs of users is now easy based on properties like MD5, sent, received to, from, subject, etc.

Multiple Search Types

A variety of search options are introduced in the software to allow users to meet their requirements for faster Office 365 forensic investigation.

• Search Types - Multiple search types like general search, regular expression, proximity search wildcard search, fuzzy search, etc help investigate all emails.
• Search Filters - Various filters like tags filter, keyword filter, custodian filter, etc play a crucial role in searching emails selectively from the bunch of files.
• Search Language - Multi-Lingual search options allow investigators to find out emails in different languages across the world in almost no time.

Analyzing Evidence

SysTools Office 365 forensics tool offers flagship analysis features that allow investigators to study evidence in depth without any sort of errors.

• Link Analysis - To find the connections between emails, the link analysis feature is quite helpful. Also, it allows investigators to track the IPs that are linked as well.
• Word Cloud - The Word Cloud feature is a unique one and helps in finding the most discussed words in the emails. Users can use this for single or multiple files.
• Timeline Analysis - Timeline analysis is the perfect solution to track and execute the evidence analysis of O365 mailbox emails from a specific date range.

Evidence Export

After the analysis of the Office 365 emails, what’s important is to export these files for keeping records. For this, Office 365 email forensics software supports plenty of file formats like EML, MSG, PST, CSV, TIFF, DAT, PDF, HTML, etc. Investigators can export their emails from Office 365 to these formats selectively based on their requirements.

Creating Reports

The final task is to create a report for the entire forensics investigation that can help users to get the overview in a nutshell. There can be N number of forensic artifacts in Office 365 and the software generate reports for them in PDF and CSV file format. To get a customized report, there are custom fields like tags, keywords, bookmarks, etc.