Acquiring Gmail History Records
History records provide activity information associated with a mailbox such as the labels that were added or removed, and the messages that were added or removed.
Google's documentation states that: "History IDs increase chronologically but are not contiguous with random gaps in between valid IDs. A history ID is typically valid for at least a week, but in some rare circumstances may be valid for only a few hours"
Accessing history records requires a starting history ID. You can acquire history records using FEC as follows:
- Configure a Gmail API acquisition.
- Enter the in-place search interface.
- Run a search preview. Based on Google's documentation, history records do not last very long. You can, for instance, run a search along the lines of newer_than:1m to pick a starting point within the last month.
- Right-click on a search result of your choice and choose the Fetch history records starting at this item context menu item.
FEC will proceed to acquire the history records and ask you for a folder where the output should be written. Once you select the folder, FEC will export a text file that contains the history records starting at the history ID of the item you selected.