Spirion (Identity Finder) - Scanning Emails

This article describes how to use Identity Finder to scan email. All documentation was performed with the most up to date versions of the email clients used and Identity Finder 10.9. All data shown is false.

In addition to scanning locations on your computer, Spirion can also scan your email for sensitive information. This includes the email body as well as email attachments.

This document contains the following topics:

Supported Email Clients and Features
Spirion only supports the scanning of the email clients listed in the table below.

Microsoft Outlook Outlook Express/Windows Mail* Mozilla Thunderbird MBOX Files Lotus Notes Microsoft Exchange Server
Outlook.png Outlook_Express.png thunderbird_icon.png folder1.png folder.png Microsoft_Exchange_Server.png
*Applies only to Windows Mail, not Windows Live Mail

For email clients not listed on the table above, it is still possible to scan the email files. However, Spirion will not use filters for these emails and instead will rely on text extraction to open and scan the files. If the extracted text does not contain a match, the file will not contain a match.

There are also several important points that should be known when using Spirion to scan emails:

  1. Attachments are scanned as separate files if the email is from a supported client. For unsupported files (IE .eml files) text extraction is used to find matches.
  2. Spirion does not support IMAP configured clients. It only supports IMAP when using Exchange.
  3. Emails must be downloaded locally to be scanned, they are not scanned on the server.
  4. Likewise, Spirion does not scan data in motion.  It does not alert the user to sensitive content in an outgoing email or attached to one.
  5. While Spirion can delete local email, it is still prudent to delete emails from the server if possible.
Scanning Emails (Win)
To configure Spirion to scan for emails:
  1. Open Spirion and navigate to the Locations tab.
  2. locationstab.PNG

  3. Choose Enable E-Mail Search from the E-Mails button drop-down menu. You can also click the E-Mail Attachments button to enable the searching of attachments.

  4. From the E-Mails drop-down menu, choose Customize E-Mail Settings.
  5. From this menu you can configure what clients and files Spirion will scan for sensitive information.

    1. You can scan Exchange and Outlook profiles from these options.
    2. Additional PST (Personal Storage Table) files can be scanned.
    3. Checking these boxes scans Thunderbird, Outlook Express, and Windows Mail.
    4. MBOX files can be scanned as well as extensions that are customizable using these options.

  6. Perform a scan as usual, results will appear in the results pane just as files would normally. From here you can also see the sender and subject of each email to determine false positives. However, emails and attachments can only be shredded. The other options are not available.

    Note: Shredding emails and attachments will only delete the local copy of the email. It is also prudent to delete the email from the mail server if possible.
  7. EmailResults2.png

  • Scanning for Emails (Mac)
  • Scanning email in the Mac version of Spirion works by scanning the emails as files. As such, there are several requirements that must be met in order for an email to be properly scanned.
    1. The email must be downloaded with a POP account.
    2. The email must be stored locally.
    Emails must exist on the machine being scanned. To scan for Emails, Identitity Finder uses a Spotlight filter. Messages are searched as text and not as individual files and attachments.

    Note: Since Spirion scans email files by converting them to text, attachments that are virus free should be downloaded and then searched.

    To enable Spirion to scan for emails:
    1. Launch Spirion and open the Preferences menu (⌘, shortcut)
    2. IdentityFinderPreferences.png

    3. From the Preferences window, select File Types
    4. Choose Custom file typle list and click the Manage button.
    5. ManageWindow.png

    6. From this window, make the Mail box is checked.
    7. SelectingMail.png

    8. Click OK on the box that appears
    9. WarningMessage.png

    10. Run a scan as normal ensuring you scan the desired folders for mail. Apple Mail by default is located under USERNAME/Library/Mail.
    11. EmailScanResults.png

    Additional Documents
    Below are are additional documents that provide information for configuring various email clients. Since Spirion can only scan scan email clients configured using POP, a document explaining the differences between the various email download formats is also provided.

    Spirion (Identity Finder) - Advanced Searching - How to search other locations and file types.

    Keywords:idf pii identity finder data discovery e-mail pop thunderbird email imap pop live   Doc ID:14583
    Owner:Julie J.Group:Office of Cybersecurity
    Created:2010-06-30 19:00 CDTUpdated:2021-05-03 11:27 CDT
    Sites:DoIT Help Desk, Office of Cybersecurity
    Feedback:  5   0