Output Container Naming

It is possible to configure the naming structure Forensic Email Collector (FEC) uses for its output containers such as PSTs and VHDX disk images. The customization can be done on FEC’s Settings page as shown in the screenshot below:

The default Output Container Base Name is set to {TargetEmail}, which results in output container names reflecting the target email address such as [email protected].

The following variables can be used in the Output PST Base Name:

{CustodianFullName}
{CaseName}
{CaseId}
{ExaminerName}
{Agency}
{EvidenceId}
{ClientName}
{ClientMatterNo}
{TargetEmail}

Important Note

The variable names above are case-sensitive.

The variables will be replaced with the corresponding values supplied during acquisition setup. It is also possible to add custom text along with the variables (e.g.,  My_custom_string_{TargetEmail}_another_string)

For example, {CustodianFullName}_{EvidenceId}_for_{ClientName}_{TargetEmail} entered as the Output Container Base Name with the following acquisition details…

…where the target mailbox is [email protected] would result in:

John Doe_0005001000001_for_Acme [email protected]