Follow

Exporting PST Files in Summation and eDiscovery

Created by: Justin Johns
Created date:
Last Updated date:

Question

How can I export a PST file in Summation Pro and/or eDiscovery?

 

Answer

There are two methods to exporting a PST file.  

  1. Export reduced PST 
  2. Export new PST

A reduced PST copies the originally ingested PST file and removes any objects that were not labeled for export.  This method is considered by many to be more forensically sound as it uses the original evidence object instead of creating a new object.  A new PST file export creates a new PST, with the same name as the originally ingested PST, and populates it with the the email objects chosen for export. Both options will export PSTs in a 1:1 ratio with ingested PSTs.

Both of these methods require one of the following applications be installed on the machine running the "AccessData Work Manager" configured for Exports:

  • Microsoft Collaboration Data Objects (CDO).  This is free and available from https://www.microsoft.com/en-us/download/details.aspx?id=1004.
  • One of the below versions of Outlook:
    Outlook 2007 32-bit Standard & Professional
    Outlook 2010 32-bit Standard & Professional
    Outlook 2013 32-bit Professional Plus

New PST

Exporting a new PST is the default method used by Summation and eDiscovery.  Like all exports, the objects that are to be exported must first be labelled.  Once the objects have been labelled:

  1. Click the Explore tab on the bottom left of the Project Explorer panel
  2. Right click Export Sets and choose your export type (in this example, I chose Native)
  3. Fill in the details for the General Options and click Next
  4. In the Files to Include section, choose Output a reduced version of original PST/NSF file. (Note: ignore the term "reduced" on this menu as it will export a "new" PST file).
  5. Choose any other desired option(s) and click Export.

Reduced PST

The system can be changed so that it exports a reduced version of the original PST by editing the Work Manager's configuration file.  The full path to this file is below and can be found on the system where the Work Manager is installed.

"[drive]:\Program Files\AccessData\eDiscovery\Work Manager\Infrastructure.WorkExecutionServices.Host.exe.config"

Backup the original file and then change the line below:

<add key="ExportEmailInNewPst" value="True" />

to:

<add key="ExportEmailInNewPst" value="False" />

Once this change has been made, restart the Work Manager service (this can be done using the recycle services script).  Then follow the steps above in New PST to now export a reduced PST.  

 

Overview

IMPORTANT! - CDO does not support exporting Unicode email messages.  Attempting to export Unicode messages to PST with CDO installed will result in errors and the exported PST will be missing any Unicode email messages. 

Both CDO and Microsoft Outlook cannot be installed on the same PC. If CDO is already installed, you must uninstall it before installing Microsoft Outlook. Likewise, you may receive an error if you try to install CDO when you already have Microsoft Outlook installed.

 

Use case scenarios:

Use new PST when you have a 10 GB PST file and are exporting 500 MB. Reduced PST requires Summation to remove 9.5 GB of data. Building a new 500 MB PST would be faster. 

Use reduced PST when Use New PST when you have a 10 GB PST file and are exporting 9.5 GB. This requires Summation to remove 500 MB of data. Building a new 9.5 GB PST would take longer.

 

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments

  • Avatar
    Gary Ramsey

    This does not work for Summation 5.6.3. I've tried with both True and False and the exports always go the Reduced PST route. We're starting the prep to upgrade to 6.0.1. Is this fixed in the latest version?

  • Avatar
    Justin Johns

    Gary, I've created a ticket for one of our engineers to help you with this.

Powered by Zendesk