Overriding Automatic Provider Detection

In some cases, the provider you would like to target may not match the provider Forensic Email Collector (FEC) automatically detects based on mail exchanger (MX) records.

For example, the target organization may have recently switched from Google Workspace to M365, and perhaps you would like to target their older Google Workspace mailboxes.

Other examples might be an iCloud account created using a Yahoo email address, or a Microsoft account created using a Gmail email address. Let’s take a look at the latter scenario and set FEC up to acquire OneDrive data from a Microsoft account that was created using a Gmail email address.

We start with the target email address, and when FEC automatically picks the Google profile, switch over to Graph API using the Switch Profile hyperlink.

We can then select the Graph API profile to perform our OneDrive acquisition: