Me and my team were hired by a corporate firm to audit certain activities by officers. The team instantly started looking for corroborative evidence inside the Exchange mailboxes. We got stuck when it came to searching of evidence inside EDB files. Unfortunately, Microsoft does not offer any such API.
We tried carrying out analysis of the Exchange mailboxes via Exchange Management Shell but the results were not much convincing.
We found some useful resources through google such as
http://www.mailxaminer.com/blog/search-unmounted-edb-file/
and http://blogs.msdn.com/b/webdav_101/archive/2008/09/03/howto-read-unmounted-exchange-edb-files.aspx
Actually we are basically trying to search for some evidence inside EDB. But still we are not sure how to proceed further.
Can anyone help?
Regards
Shweta@G