Acquiring ProtonMail with FEC

ProtonMail allows access to decrypted copies of users' emails with the ProtonMail IMAP/SMTP Bridge. You can follow the steps below to acquire a ProtonMail mailbox using Forensic Email Collector:

1. Download and install ProtonMail Bridge as described below:

https://protonmail.com/bridge/install

Note: ProtonMail Bridge requires a paid ProtonMail account.

2. Add the target email account to ProtonMail Bridge via the "Add Account" button in ProtonMail Bridge. When you add the target email account to ProtonMail Bridge, ProtonMail Bridge will automatically generate credentials for use in FEC (see below). You will need the generated password in step 5 below.

https://protonmail.com/bridge/install#5

3. Once ProtonMail Bridge is running and configured, open Forensic Email Collector and enter the target email address.

4. When you click "Next", FEC will automatically select the ProtonMail acquisition profile as below and populate the server settings.

5.  Populate the password field in FEC with the password ProtonMail Bridge automatically generated in step 2 above. Do not use the mailbox password.

6. Make sure that the TCP port that ProtonMail Bridge uses (port 1143) is not blocked by a firewall or similar software.

7. Proceed with the acquisition.