Topics Map > Office of Cybersecurity > Tools and Software > Spirion
Spirion (Identity Finder) - Scanning Emails
This article describes how to use Identity Finder to scan email. All documentation was performed with the most up to date versions of the email clients used and Identity Finder 10.9. All data shown is false.
In addition to scanning locations on your computer, Spirion can also scan your email for sensitive information. This includes the email body as well as email attachments.
This document contains the following topics:
- Supported Email Clients and Features
- Scanning Emails (Win)
- Scanning Emails (Mac)
- Additional Documents
Spirion only supports the scanning of the email clients listed in the table below.
Microsoft Outlook | Outlook Express/Windows Mail* | Mozilla Thunderbird | MBOX Files | Lotus Notes | Microsoft Exchange Server |
---|---|---|---|---|---|
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
For email clients not listed on the table above, it is still possible to scan the email files. However, Spirion will not use filters for these emails and instead will rely on text extraction to open and scan the files. If the extracted text does not contain a match, the file will not contain a match.
There are also several important points that should be known when using Spirion to scan emails:
- Attachments are scanned as separate files if the email is from a supported client. For unsupported files (IE .eml files) text extraction is used to find matches.
- Spirion does not support IMAP configured clients. It only supports IMAP when using Exchange.
- Emails must be downloaded locally to be scanned, they are not scanned on the server.
- Likewise, Spirion does not scan data in motion. It does not alert the user to sensitive content in an outgoing email or attached to one.
- While Spirion can delete local email, it is still prudent to delete emails from the server if possible.
To configure Spirion to scan for emails:
- Open Spirion and navigate to the Locations tab.
- Choose Enable E-Mail Search from the E-Mails button drop-down menu. You can also click the E-Mail Attachments button to enable the searching of attachments.
- From the E-Mails drop-down menu, choose Customize E-Mail Settings.
- From this menu you can configure what clients and files Spirion will scan for sensitive information.
- You can scan Exchange and Outlook profiles from these options.
- Additional PST (Personal Storage Table) files can be scanned.
- Checking these boxes scans Thunderbird, Outlook Express, and Windows Mail.
- MBOX files can be scanned as well as extensions that are customizable using these options.
-
Perform a scan as usual, results will appear in the results pane just as files would normally. From here you can also see the sender and subject of each email to determine false positives. However, emails and attachments can only be shredded. The other options are not available.
Note: Shredding emails and attachments will only delete the local copy of the email. It is also prudent to delete the email from the mail server if possible.
- The email must be downloaded with a POP account.
- The email must be stored locally.
Note: Since Spirion scans email files by converting them to text, attachments that are virus free should be downloaded and then searched.
To enable Spirion to scan for emails:
- Launch Spirion and open the Preferences menu (⌘, shortcut)
- From the Preferences window, select File Types
- Choose Custom file typle list and click the Manage button.
- From this window, make the Mail box is checked.
- Click OK on the box that appears
- Run a scan as normal ensuring you scan the desired folders for mail. Apple Mail by default is located under USERNAME/Library/Mail.
Below are are additional documents that provide information for configuring various email clients. Since Spirion can only scan scan email clients configured using POP, a document explaining the differences between the various email download formats is also provided.
Spirion (Identity Finder) - Advanced Searching - How to search other locations and file types.