Topics Map > Office of Cybersecurity > Tools and Software > Spirion

Spirion (Identity Finder) - Scanning Emails

In addition to scanning locations on your computer, Spirion can also scan your email for sensitive information. This includes the email body as well as email attachments.

This document contains the following topics:

• Supported Email Clients and Features
• Scanning Emails (Win)
• Scanning Emails (Mac)
• Additional Documents

Supported Email Clients and Features
Spirion only supports the scanning of the email clients listed in the table below.

Microsoft Outlook	Outlook Express/Windows Mail*	Mozilla Thunderbird	MBOX Files	Lotus Notes	Microsoft Exchange Server

*Applies only to Windows Mail, not Windows Live Mail

For email clients not listed on the table above, it is still possible to scan the email files. However, Spirion will not use filters for these emails and instead will rely on text extraction to open and scan the files. If the extracted text does not contain a match, the file will not contain a match.

There are also several important points that should be known when using Spirion to scan emails:

1. Attachments are scanned as separate files if the email is from a supported client. For unsupported files (IE .eml files) text extraction is used to find matches.
2. Spirion does not support IMAP configured clients. It only supports IMAP when using Exchange.
3. Emails must be downloaded locally to be scanned, they are not scanned on the server.
4. Likewise, Spirion does not scan data in motion.  It does not alert the user to sensitive content in an outgoing email or attached to one.
5. While Spirion can delete local email, it is still prudent to delete emails from the server if possible.

Scanning Emails (Win)
To configure Spirion to scan for emails:

1. Open Spirion and navigate to the Locations tab.




2. Choose Enable E-Mail Search from the E-Mails button drop-down menu. You can also click the E-Mail Attachments button to enable the searching of attachments.




3. From the E-Mails drop-down menu, choose Customize E-Mail Settings.
4. From this menu you can configure what clients and files Spirion will scan for sensitive information.

   
   

   1. You can scan Exchange and Outlook profiles from these options.
   2. Additional PST (Personal Storage Table) files can be scanned.
   3. Checking these boxes scans Thunderbird, Outlook Express, and Windows Mail.
   4. MBOX files can be scanned as well as extensions that are customizable using these options.
   
   
5. Perform a scan as usual, results will appear in the results pane just as files would normally. From here you can also see the sender and subject of each email to determine false positives. However, emails and attachments can only be shredded. The other options are not available.
   
   Note: Shredding emails and attachments will only delete the local copy of the email. It is also prudent to delete the email from the mail server if possible.

Scanning for Emails (Mac)

Scanning email in the Mac version of Spirion works by scanning the emails as files. As such, there are several requirements that must be met in order for an email to be properly scanned.

1. The email must be downloaded with a POP account.
2. The email must be stored locally.

Emails must exist on the machine being scanned. To scan for Emails, Identitity Finder uses a Spotlight filter. Messages are searched as text and not as individual files and attachments.

Note: Since Spirion scans email files by converting them to text, attachments that are virus free should be downloaded and then searched.

To enable Spirion to scan for emails:

1. Launch Spirion and open the Preferences menu (⌘, shortcut)



2. From the Preferences window, select File Types
3. Choose Custom file typle list and click the Manage button.



4. From this window, make the Mail box is checked.



5. Click OK on the box that appears



6. Run a scan as normal ensuring you scan the desired folders for mail. Apple Mail by default is located under USERNAME/Library/Mail.

Additional Documents
Below are are additional documents that provide information for configuring various email clients. Since Spirion can only scan scan email clients configured using POP, a document explaining the differences between the various email download formats is also provided.

Spirion (Identity Finder) - Advanced Searching - How to search other locations and file types.