Identity Finder (Win) - Scanning Emails

This article describes how to use Identity Finder to scan email. All documentation was performed with the most up to date versions of the email clients used and Identity Finder All data shown is false.

In addition to scanning locations on your computer, Identity Finder can also scan your email for sensitive information. This includes the email body as well as email attachments.

This document contains the following topics:

Supported Email Clients and Features
Identity Finder only supports the scanning of the email clients listed in the table below.

Mozilla Thunderbird Windows Mail* Outlook Outlook Express MBOX Files
thunderbird_icon.png windows_mail_icon.png outlook_2007_icon.png oe6.jpg folder.png
*Applies only to Windows Mail, not Windows Live Mail

For email clients not listed on the table above, it is still possible to scan the email files. However, Identity Finder will not use filters for these emails and instead will rely on text extraction to open and scan the files. If the extracted text does not contain a match, the file will not contain a match.

There are also several important points that should be known when using Identity Finder to scan emails:

  1. Attachments are scanned as separate files if the email is from a supported client. For unsupported files (IE .eml files) text extraction is used to find matches.
  2. Identity Finder DOES NOT support IMAP configured clients. It only supports IMAP when using Exchange.
  3. Emails must be downloaded locally to be scanned.
  4. While Identity Finder can delete local email, it is still prudent to delete emails from the server if possible.
Scanning Emails
To configure Identity Finder to scan for emails:
  1. Open Identity Finder and navigate to the Locations tab.

  2. Choose Enable E-Mail Search from the E-Mails button drop-down menu. You can also click the E-Mail Attachments button to enable the searching of attachments.

  3. From the E-Mails drop-down menu, choose Customize E-Mail Settings.
  4. From this menu you can configure what clients and files Identity Finder will scan for sensitive information.

    1. You can scan Exchange and Outlook profiles from these options.
    2. Additional PST (Personal Storage Table) files can be scanned.
    3. Checking these boxes scans Thunderbird, Outlook Express, and Windows Mail.
    4. MBOX files can be scanned as well as extensions that are customizable using these options.

  5. Perform a scan as usual, results will appear in the results pane just as files would normally. From here you can also see the sender and subject of each email to determine false positives. However, emails and attachments can only be shredded. The other options are not available.

    Note: Shredding emails and attachments will only delete the local copy of the email. It is also prudent to delete the email from the mail server if possible.
  6. EmailResults2.png

Additional Documents
Below are are additional documents that provide information for configuring various email clients. Since Identity Finder can only scan scan email clients configured using POP, a document explaining the differences between the various email download formats is also provided.

Document 1535 is unavailable at this time. - Differences between various formats.

Document 5320 is unavailable at this time. - Make sure to configure using POP if you want Identity Finder to properly scan emails.

Identity Finder (Win) - Advanced Searching - How to search other locations and file types.

Keywords:idf pii identity finder data discovery e-mail pop thunderbird windows email imap pop windows live   Doc ID:14583
Owner:Allen M.Group:Office of Campus Information Security
Created:2010-06-30 18:00 CSTUpdated:2014-11-18 11:48 CST
Sites:DoIT Help Desk, Office of Campus Information Security
Feedback:  4   0