Collecting Cloud-Based Email Accounts

Overview

This technical note provides instructions for collecting electronically stored information (ESI) located in cloud-based email accounts.  The collection process is typically performed by a third-party eDiscovery or forensic provider, or organizational IT staff. However, there are programs and methods available to assist with collection if the need arises by law firm staff or other persons.  This generally requires a medium to a high degree of technical ability to do correctly.

Background

Parties to litigation are generally required to use reasonable, good faith, and proportional efforts to preserve, identify, collect, and produce relevant information. This includes identifying appropriate limits of discovery, such as custodians, identification of relevant subject matter, time periods for discovery collection and similar parameters to guide preservation and discovery issues.

Once the scope of discovery has been determined, the next step is to collect the data.  When the ESI is located in a cloud-based email account, it will not be stored on the local computer hard drive, therefore, separate collection steps need to be taken.  

Typically emails are exported as part of a container file called a PST or MBOX file.  This basically means that once the emails to be collected have been identified (a subset or all) within the cloud-based email account, the way to “get them out” into a tangible data set is to export them from the cloud-based email account.  The most common export format option is the PST file, originally developed by Microsoft for Outlook software. The Lexbe eDiscovery Platform (LEP) can automatically process PST files, but many other email container files must be converted to PST first before upload. 

One methodology to collect cloud-based email is to set up an empty Outlook PST file, and then sync the Outlook file to the cloud-based email account using POP or IMAP.  POP and IMAP are email network storing protocols. A POP account downloads the email inbox, while an IMAP client synchronizes the email on local Outlook client with the contents of the account on the email server.  The IMAP is a more comprehensive as it can retrieve folders information, but it is not as fully supported as the older and more ubiquitous POP format. Whichever protocol is used, care must be taken with the account and Outlook settings to assure that email in the cloud account is not deleted, if that is not the intention.

Collecting with Aid4Mail

Aid4Mail is eDiscovery industry standard collection software used by many in the eDiscovery industry for cloud-based email collections.  If collection is required, Lexbe recommends using Aid4Mail. It is highly respected as being fast, accurate, reliable and defensible. Aid4Mail supports a broad list of the supported email types and cloud providers, which can be found here.  Please note, Microsoft Outlook must be installed in order for Aid4Mail to process.  For more information on purchasing and functionality, please visit their website: Aid4Mail

The instructions below assume the Aid4Mail program and Microsoft Outlook have been purchased and installed on a local computer.  

a. You may need to update the email account’s security settings temporarily to less secure app access just until the collection is complete.  You can restore to more restrictive security setting once collection is complete.

5. The next screen will be the IMAP/POP Source Settings

6. Select the specific mail carrier from the Settings drop-down box (Gmail, Yahoo! Mail, Outlook.com, etc)

7. Once you select the mail carrier, default settings are applied for all categories except username, password, max folder depth and length.  Input those details for the email account to be collected and click Next

8. In the next screen, select all folders to be included in the collection and click Next

9. The next screen is Filter Options; select/input all that apply and click Next (date ranges, keywords, sent vs received etc).  Please note, filters can also be applied directly in the Lexbe eDiscovery Platform (LEP) after ingestion

10. Next select PST as the Target Format; click Next

11. The next screen pertains to the output PST file

a. Target Location Folder: where the PST file will be saved

b. Target Location File name: what the PST file will be called

c. You can apply the further details as needed, including a password for the PST file

d. Click Next

12. Below are the default settings for the Export Options; adjust as needed, click Next

13. On the next screen, click Start to begin the processing

14. Once complete, a Finished Processing Mail notification will be displayed along with a processing report

15. The PST file will now be in the target location previously specified.  From here, the PST file can be distributed as needed for LEP upload

16. Save the processing report and QC final message count after LEP processing completes.

Collecting without Aid4Mail

While using Aid4Mail is highly recommended for self-collection of cloud-based email accounts, most cloud-based email providers have export functionality.  Exporting directly from the email account is functional, but arguably not as defensible especially when performed as a self-collection.

Below is a list of the major cloud-based email providers along with links to their export instructions.  When available, always export emails as a PST file to allow automatic processing within LEP. If PST is not an export option, choose MBOX.  An MBOX file generally can then be converted to PST prior to LEP upload using available Lexbe Professional Services conversion services.

Google Gmail (exports as MBOX)- Download your data

Apple Mac Mail (exports as MBOX) - Export mailboxes in Mail on Mac

MSN/Hotmail - the best way to export Microsoft cloud-based emails to PST is through the Microsoft Outlook App;  See Add your Outlook.com account in Outlook for Windows and Export email to Outlook .pst file

Yahoo! Mail - There is no export option for Yahoo! Mail; instead, emails can be downloaded to a third party email app (like Thunderbird, Outlook, Mac Mail etc) and exported from there.  For instructions, see Download your email from Yahoo Mail with IMAP

Additional Information

Lexbe’s Professional Services team is available to perform cloud-based email collections upon request as a billable service.  For more information, please contact professionalservices@lexbe.com