Quick start guide

High-level workflow for MailArtifact Email Investigator. Detailed manuals ship with the installer.

1. 1

   Create a case

   Start a new case folder on your workstation. All evidence, indexes, and audit logs stay under that directory.

2. 2

   Add evidence

   Use the evidence wizard to import mail stores, cloud exports, or disk images. Enable OCR when you expect scanned PDF attachments.

3. 3

   Search and analyze

   Filter by custodian, tags, PII, item type, and full-text including attachment text where indexed.

4. 4

   Export and report

   Produce load files and investigation reports with documented actions from the audit log.