Using FEC Remote Authenticator
FEC Remote Authenticator is a standalone application that you can provide to the owner of a Gmail, G Suite, or Office 365 email account so that they can authenticate you remotely. This can be especially useful when the custodian uses two-factor-authentication. Using FEC Remote Authenticator, eDiscovery and digital forensics practitioners do not have to know the custodian's email password at all.
The remote authentication workflow works as follows:
Custodian (owner of the mailbox) downloads a copy of FEC Remote Authenticator using the download link available on the Forensic Email Collector (FEC) user interface under the "Remote Authentication" menu.
FEC Remote Authenticator is a single EXE file that does not require extraction, installation, administrative privileges or a license key. It does require that the custodian's computer have .NET framework 4.5 installed.
The custodian runs FEC Remote Authenticator and authenticates with Gmail, G Suite, or Office 365 using the same workflow as FEC. FEC Remote Authenticator does not ask for the custodian's password; the password is provided directly to Google or Microsoft. If two-factor authentication is enabled, the custodian can perform the two-factor-authentication via the Gmail or Office 365 web interface as usual.
Once authentication is complete, the following screen is displayed where the custodian can save an encrypted FEC Remote Authentication Token.
The saved token has a file name in the following format:
Once the token file is saved, the custodian can send the token file to you using the channel where you ordinarily exchange sensitive files with each other (e.g., file transfer system, secure FTP, etc.)
Once you receive the token file, you can launch FEC and import it using the "Remote Authentication" menu as follows:
Once the token is imported, you can perform the acquisition without having to authenticate with Gmail, G Suite, or O365 on your end.
Once email preservation is complete, the custodian can go to their account security settings and revoke access to FEC as follows:
Gmail / G Suite
2. Expand Forensic Email Collector and click the REMOVE ACCESS button.
2. Click the Revoke button next to Forensic Email Collector.
Once access is removed, the FEC Remote Authentication Token will be invalidated. You can no longer use the token to access the custodian's emails.
Advanced Scope Customization via Filename
By default, Remote Authenticator requests full access to Gmail and read-only access to Google Calendar and Drive. This is to accommodate all scenarios while keeping things simple—IMAP access to a Gmail / G Suite mailbox requires full permissions.
In some cases, you may prefer to customize the permissions that Remote Authenticator requests to fit your workflow. For example, if you are certain that you won't need IMAP access, there is no reason to request full Gmail permissions—you could go with read-only Gmail access instead.
It is possible to change Remote Authenticator's behavior by setting flags in the executable's filename. Valid flags are as follows:
R: Request read-only Gmail access. When not set, Remote Authenticator will request full Gmail access.
D: Request read-only Drive access. When not set, Remote Authenticator will not request access to Drive API.
C: Request read-only Calendar access. When not set, Remote Authenticator will not request access to Calendar API.
In order to set these flags, put them between a set of double underscores in the Remote Authenticator filename (e.g., __RDC__). Here are some examples:
FECRemoteAuthenticator_v1.11.1.exe No flags are set. Default permissions will be requested (i.e., full Gmail, read-only Drive, read-only Calendar).
FECRemoteAuthenticator_v1.11.1__RDC__.exe Read-only access to Gmail, Drive, and Calendar. This allows all API-based functionality, but not IMAP.
FECRemoteAuthenticator_v1.11.1__RC__.exe Read-only access to Gmail, and Calendar. This allows a standard API-based Gmail acquisition without Drive attachment support.
FECRemoteAuthenticator_v1.11.1____.exe This will only request full access to Gmail, but no access to Drive or Calendar. Suitable for IMAP acquisitions only.
Important Note: The "__R__" and "__RD__" flag configurations are invalid because FEC requires access to Calendar API when performing a Gmail API acquisition.
Why Use the Filename for Scope Customization?
You might be wondering why the scope customization is done by using the filename of the executable rather than options within Remote Authenticator. The goal here is to allow the requestor to hard-code the scopes they need by setting the filename ahead of time. Otherwise, the requestor would have to provide further instructions to the end-user to choose the appropriate settings, which is not always desirable.