Email

Acquiring Email in the Field Using FTK

What you will need to bring with you

• The external 1 TB external hard drive. This should be inside the Tableau Bridge bag, but verify before you leave the office.
• A print or electronic copy of the Donor Interview Form to complete on-site.
• If you are copying from USB or Firewire devices in the field, you will also need a laptop with FTK on it and the Tableau Bridge. (See separate instruction sheet, “ACQUIRING RECORDS IN THE FIELD FROM USB AND FIREWIRE DEVICES.”) Laptop will require two USB ports (or one USB and one Firewire slot).
• If you are acquiring other types of records, see separate instruction sheet “ACQUIRING ELECTRONIC RECORDS IN THE FIELD USING FTK”.

Note: Donor computer must have a USB or FireWire port in order to acquire records in the field.

What you should talk to the donor about before you start to image anything
Note: Please use the Donor Interview Form to record your answers to the below questions, which are part of the interview instrument.

• Are you are here to acquire one particular group of email or the entire account?
• Is the email account web-based or client-based (such as Outlook)? What version?
• Ask the donor to provide you with information about the records you are transferring. Questions might include:
• When were the records created?
• For what purpose were they created?
• How is the email grouped?
• Did s/he copy the email to the computer off of other media? Are these copies of files that came from earlier computers?
• Was the email created at work and “brought home” for reference purposes?
• Did someone else participate in file creation?
• What does s/he intend to do with the files once you copy them?
• Record the brand/model of the donor’s computer.
• Record the operating system in use on the donor computer.

Set Up

1. Turn on the donor’s computer.
2. Connect the external hard drive to the donor’s computer.
3. Open the external hard drive (go to “Computer” and look under external devices).
4. On the external hard drive, create a folder for your transfer. For example, Doe,John_08102013_EmailTransfer01
5. Launch FTK (use the FTK Imager – Shortcut icon).

Export Email from Donor Account

From Microsoft Outlook:

1.  Create a destination folder on your computer or removable storage media (example: email_DoeJohn20130810).
2. Export the select folder(s) from the email account and export as a .pst file:
   
   • In Outlook, go to: File>Options>Advanced>Export
   • Select “Export to a File” and click “Next”
   • Select “Outlook Data File (.pst) and click “Next”
   • Highlight the folder you want to export (ideally the top-level folder named with the account email address). Click “Next.”
   • Click the “Browse” button to select the destination folder created in step 1. Click “OK”
   • Select the radio button for “Allow duplicate items to be created.” Click “Finish”
   • Do NOT enter a password. Click OK.
   • Close out of Outlook.
     
     Resource for Donors: Instructions are clearly articulated with screen shots on this website: http://support.sherweb.com/Faqs/Show/how-to-export-an-outlook-2010-pst-file-exchange-2010
     Be sure to point out that the Donor should select the option to "Allow duplicate items to be created" in step 6.
3. Open the destination folder and look at the file size of the .pst file (if 0, export did not work).

Create Disk Image Using FTK

1. In FTK, Go to File-->Create Disk Image.
2. Pick the Contents of a folder option and click on Next.
3. A message will pop up saying you have opted to create a logical image of a folder (etc.). Click on “Yes”.
4. Browse for the folder you want to image, select, and click on OK.
5. Click on Finish.

6. The “Create Image” will open. Click on Add.

   Verify the disk image was created. Go to folder you created on the external hard drive for your transfer and verify the disk image and supporting processes documentation files were created (a .txt document detailing processes and checksums and a spreadsheet for the disk directory). DO NOT TRY TO OPEN THE DISK IMAGE

   1. Fill out Evidence Item Information form and the click Next. NOTE: If you are creating an image of a CD or DVD, FTK skips this step.
      1. The Case Number = the donor’s name (Last,First) OR accession number, for institutional collections (accXXXX-XXX, for example: acc2021-001). 
      2. The Evidence Number = the date of acquisition, in Year-MM-DD format
      3. The Unique Description =  In you are copying multiple folders, put in the transfer number here, for example: DoeJohn_Email20130810_01 OR acc2021-001_Email_01)
      4.  The Examiner = the name of the person acquiring the records in Last name, First name format (for example: Gustainis,Emily)
      5. Click on Next
         1. Next to “Image Destination Folder,” click on Browse. Select the folder you created on the external hard drive for the transfer.
      6. For the Image Filename, use the same name as the Unique Description, for example: DoeJohn_Email20130810_01
      7. Click on Finish to continue.
         
         
7. Make sure that the “Verify images after they are created” and the “Create directory listings of all files in the image after they are created” checkboxes are checked.

8. Click Start. A window will open, indicating progress on the disk imaging and directory creation process.

9. When the process is complete, click on Close (for all open windows).

10. Verify the disk image was created. Go to folder you created on the external hard drive for your transfer and verify the disk image and supporting processes documentation files were created (a .txt document detailing processes and checksums and a spreadsheet for the disk directory). DO NOT TRY TO OPEN THE DISK IMAGE

Copy Images to Shared Drive

1. Log in to FRED workstation using your eCommons Username and Password.
2. Create a folder structure for the acquired disk images, imaging and related documentation, and extracted files (use copies):
   1. In N:\Electronic_Accessions, create a folder for your transfer in either the Archives or Manuscripts folder.

   If you are accessioning to the archives, use the following folder structure and naming conventions as below:

   
   

   

    

   Note that the third level folder contains the Office Number, Office Name, and has “_erecords” appended to the name. The fourth level folder has the Series Number and Series Name and has “_erecords” appended to the name. The fifth level folder should be named using the Accession Number and have “_email” appended to the name. If you do not have an accession number, use the date of transfer: DOTemail_20131016 to name the folder. All files and documentation live within the fifth level folder.

   In the fifth folder, create three folders:

   i.  Disk Images (Masters)
   ii.  Documentation
   iii. Extracted Use Copies for Processing

   If you are acquiring a manuscript collection, use the following folder structure and naming conventions as below:

   

   All files and documentation live within the third level folder.

   In the third folder, create three folders:

   i.  Disk Images (Masters)
   ii.  Documentation
   iii. Extracted Use Copies for Processing

   
   
   
3. Insert external hard drive using the USB 3 slot in the “Imaging Shelf” area.
4. Create disk image using FTK.
   1. Open FTK.
   2. Go to File-->Create Disk Image.
   3. Pick the Image File option and click on Next.
   4. Browse for image file in the transfer you created on the external hard drive (will be an .ad1 or .aff) and click on Finish.
   5. Click on Add.
      1. Fill out Evidence Item Information form and the click Next.
         1. The Case Number = the donor’s name (Last,First) OR accession number, for institutional collections (accXXXX-XXX, for example: acc2021-001). 
         2. The Evidence Number = the date of acquisition, in Year-MM-DD format
         3. The Unique Description =  In you are copying multiple folders, put in the transfer number here, for example: DoeJohn_20130810_01 OR acc2021_01
         4. The Examiner = the name of the person acquiring the records in Last name, First name format (for example: Gustainis,Emily)
   6. Next to “Image Destination Folder,” click on Browse. Locate the “Disk Images (Masters)” folder for your transfer. (For example, in: N:\Electronic_Accessions\Archives\M-CE10.01_Osher Research Center_erecords\Series 00336_Sponsored Project Administration_eRecords\Acc. 2013-031_email\disk images).
   7. Enter the transfer file name in the image filename box (for example: DoeJohn_Email20130810_01).
   8. Click on Finish to continue.
   9. Make sure that the “Verify images after they are created” and the “Create directory listings of all files in the image after they are created” checkboxes are checked.
   10. Click Start. A window will open, indicating progress on the disk imaging and directory creation process.
   11. When the process is complete, click on Close (for all open windows).
5. Verify the disk image was created. Go to the Disk Images (Masters) folder you created for your collection and verify the disk image and supporting processes documentation files were created (a .txt document detailing processes and checksums and a spreadsheet for the disk directory). DO NOT TRY TO OPEN THE DISK IMAGE
6. In Disk Images (Masters), create a new folder to cut and paste from Disk Images (Masters) to the “Documentation” folder. Name the folder using the transfer name. For example: Acc. 2013-031_emaildocumentation. Put the .txt and the spreadsheet generated by FTK in this folder.
7. Cut the folder and paste it in the  Documentation.
8. Extract files from disk image.
   1. Go back to FTK.
   2. Go to File-->Add Evidence Item.
   3. From the list, select Image File.
   4. Using Browse, select the disk image (.aff or .ad1 you created from the Disk Images (Masters) folder. Click Finish.
   5. Image will show up in “evidence tree” pane on left.
   6. Highlight the file.
   7. Go to File-->Export files.
   8. Select the location the files should be extracted to using Browse. Pick the Extracted Use Copies For Processing folder you created and click on OK to export to this location.
   9. In the Extracted Use Copies for Processing folder, create a folder for the files extracted from the disk image. For example, if the image was named “DoeJohn_Email20130810_01,” create a folder called  DoeJohn_Email20130810_01_UseCopies.
   10. Drag and drop all extracted files to the “UseCopies” folder you just created.
9. Exit FTK.

Review Email using AID4MAIL (to be installed on FRED station)

1. Launch Aid4Mail.
2. Navigate to the DoeJohn_Email20130810_01_UseCopies folder as the place to save the email Aid4Mail will create from the .pst file.
3. After selecting export location, you will get a complete folder structure that Aid4Mail generates from the .pst, each folder with a checkbox next to it (everything is checked by default). Aid4Mail will process any folder you leave checked.
4. Click next (or process) – don’t FILTER for anything, just process all.
5. Pick the DoeJohn_Email20130810_01_UseCopies as the destination folder for the processed email.
6. Click Start (processing can take a while).
7. A mail folder will be created. When you open it, you will see the same structure as the original account. You can navigate folders and open email files right from there. You can also filter and keyword search email.