Feature Ideas

As consultants we are asked to collect all of these items in addition to a mailbox. Currently one can do so using Axiom; however Axiom doesn't come anywhere close to the efficiency and capability of FEC.

Make the output paths in an FEC project relative so that the project can continue to work even if it’s moved to a different location. Example: You start an acquisition with the output path “X:\Client Files\12314.123\Emails\1234” and then move the project to “Z:\New Project Path”. The project, in its new location on the Z: drive, remains fully operational/resumable.

Make it possible to enter a custom PST base name—instead of the target email address—during acquisition setup.

Provide an option to have FEC output the acquired items inside a container file such as a virtual hard disk (VHD), AFF4 image, logical evidence file (L01), ZIP archive, 7-Zip archive, etc. If you are interested in this feature, please upvote and/or reply below and let us know which output format you would prefer.

When you currently enable the option MIME container , FEC saves the files to both a vhdx and also to a subfolder inside the project. So now you have twice the data, which we do not need. We only need the vhdx for the MIME files. Can you make an option so that we can choose what output we need? So either only MIME in folder, MIME as vhdx (containerized) or both?

Currently the containerize VHDX is a great option, but I would also like it to include the Logs, Drive attachments as well making it an even better option. Can we make this happen? :)

You said "FEC’s in-place search preview features to run a query or even run a list of search expressions and get hit counts, but this works at the individual mailbox level, not across the board." It would be very useful in both eDiscovery and forensic investigation cases to do a pre-search and identify a subset of accounts that may have relevant hits. Both in the triage of accounts to collect or to identify other relevant email users in an organization

When the PST output option is selected, include the EntryID of each item written to the output PST in the Downloaded Items Log. This will help correlate items within an output PST with the list of items in Downloaded Items log for metadata overlays, mailbox remediation with Obliterator, etc.

Allow management of credentials in existing acquisition projects to support the following workflows: Replace a Remote Authenticator token with a new one This can be useful if the authentication token is accidentally invalidated by the end-user during the acquisition and has to be replaced without starting the acquisition over. Change the target account password/app password Similarly, for acquisitions involving legacy username/password authentication, make it possible to change the password in an acquisition project in case the end-user accidentally revokes the app password that was provided. Clear Credentials Make it possible to clear the credential cache in an acquisition project at any time, preventing FEC from being able to authenticate with the target mailbox in the future. Automatically Close Acquisition Projects When an acquisition finishes successfully (i.e., there are no remaining items that could be acquired), automatically clear the credential cache of the acquisition project.

FEC currently allows users to bulk-create acquisitions from a list of targets and then run them one after the other from the command line or using a batch file output by FEC. Improve on this functionality by adding a Queue Manager GUI for a more streamlined workflow.