E-mail recovered from a desktop or laptop computer can hold substantial amounts of data, but e-mail stores held on network servers, even modest-sized stores, can hold numerous messages and attachments, requiring special programs to select and manage them properly. The following subsections further describe how these datasets are managed and how the practitioner may undertake a more efficacious approach to e-mail analysis and identification.
In the following figure, ILookIX has deconstructed e-mail messages from a single account holding more than 28,000 e-mail messages and attachments. The files appear in a structure, reflecting the e-mail directory structure, files, and attachments as shown on the original device. This makes it easy for the practitioner to become oriented with the e-mail layout and gain a quick perspective of the mail system: