Convert EDB to PST – Steps for Preserving Exchange Server Emails

Corporate desktops, laptops, and server system are prime source of evidences in digital investigation. Earlier, while collecting data from these sources, companies had to follow the server shut-down processes which brought downtime in businesses affecting the work flow. This also carried negative impacts on the organisations where servers play an important role of preserving and managing databases. This not only ruined the businesses, but also wasted precious time in making databases available for parsing of emails and other data. To move Exchange 2010 mailbox to PST is most important because Exchange files contains the important data. Nowadays investigators have various mediums and methodologies to preserve email data from live running servers to accessible formats on investigation work-stations. Microsoft Exchange, which is the most popular emailing server in corporate follows up downtime while performing the investigation on its emails.

Collect Emails from Live Exchange Server to Outlook PST File

In order to make it possible to work on the email investigation of server based emails, it is important to bring the emails from the server to more convenient platforms. Exchange emails can be accessed only when mounted on the server which is restricted in many aspects for an investigator perspective. In such situation, it is important to convert EDB to PST file or any other convenient accessible format which can be viewed and analyzed without any bindings. Following methods can be used for this requirement

• Export copy of suspect’s mailbox from Exchange Server by configuring an MS Outlook email client i.e. convert EDB to PST.
• Mailbox Merge application also known as Exmerge can be utilized in order to export mailbox to Outlook PST file.
• Exchange Management Shell in Exchange version 2007 can be utilized for exporting copy of mailbox.
• Extracting data from the backup of the Exchange Server “Information Store” from complete backup of the server.
• Creating copy of database files to other media by dismounting the databases by putting off the Exchange Server temporarily.
• Specialized commercial third-party utility like Exchange EDB to PST software application can be a perfect medium for EDB to PST conversion.

Steps to Migrate (Convert) Exchange Mailbox to Outlook PST File

Various scenarios like large volume of mailboxes, potential risks towards logging in with suspect’s credentials, and unable to carve permanently deleted items or dumpster’s items can propel investigators to go for a professional help to attain complete mailbox in PST file. Below mentioned steps can provide conversion of Exchange EDB mailbox to PST file which can be then analyzed in detail

• Launch Exchange EDB to PST software.

• Once the software is launched successfully, click on Add File available in main menu. This will open another window where you can add the EDB files along with STM files (if available) to be converted to PST file.

• When the EDB files are added to the software successfully, a full-fledge preview is provided of emails belonging to all the mailboxes available in the EDB file. Software itself provides a temporary access to all the emails which otherwise cannot be accessed without Exchange server.

• Selective Export of emails can be done using this software. Once the emails are selected, click on Export option in order to migrate the emails from Exchange mailbox to MS Outlook PST file. This will open another window where advance Export options like Split PST can be done. Click on Browse and provide the destination where the exported PST files will be saved and click on Export

Conclusion: Exchange EDB to PST converter unlocks the complexities at various stages and serves a complete migration from the Exchange server mailboxes to an accessible Microsoft Outlook PST file. Once the emails are exported to PST files, it can be easily accessed without needing the server environment. The analysis on the PST files can be done precisely afterwards.