Introduction of Pegasus
The time of widespread computing technology has extended the doors for criminal activities. Nowadays, it has been recognised that the most common type of litigation case in the court of law is theft of intellectual property. Usually, such type of case includes an employee who has passed on valuable company related information to the third-party via email messages. In order to deal with cases where the employee violates organizational norms, the law enforcement agencies take the help from the team of forensic investigation which can carve out right evidence so as to prove the accusatory guilty before law.
As forensic investigators has to deal with such types of cases, they need to perform through analysis of the email client and its messages. Now how will forensic examiners carve out evidence if the email client involved over here is Pegasus Mail? Before going into deep discussion about forensic, let's first understand into Pegasus email application.
How to start Pegasus mailbox analysis
Pegasus is free mail client application which has been designed with myriad of excellent attributes to provide secured and safe form of communication on Windows operating system. It has been developed with advance set of features in order to filter incoming messages and to control spamming using the Content control and Spamhalter filtering techniques. Further, the mail client supports many POP and IMAP accounts from one single account.
Procedure of extracting evidence
During the procedure of Pegasus mailbox analysis, first it is necessary to know the basic mechanism related to the storage files and folders. If you talk about general email application such as Pegasus, it is quite normal that there is an interaction of two servers. One is for incoming and other one is for outgoing. Whenever user requires to read out a mail message, the Pegasus email client connects to the particular mail server by using any of the protocols:
Whenever forensic investigations are carried out by the examiners, the protocol which is used for gathering incoming messages is not the interest. Here, the most important is how the role of these protocols affects where the email messages are saved. The message structure in the New Mail folder is slightly different. Here, each messages stored as individual files whereas other folders like main folder or junk have all their messages stored in a .PMM file with a corresponding index file that has .PMI extension. So, for respective folder, there is a file pair.
These format represent attachment files. These get created when local messages are sent with attachments. They are indicated with a message that has a p.
These are known as annotation files and are related with relevant messages through message id.
These files are connected with a sharing list. Sharing list are text files with each line having one email address. Suppose, a message has been sent to @
This file stores all the important information about the folders list which was used the last time P mail was started. Therefore forensic examiners can take a look into the folders in which it can provide details to the activities of the employees.
During Pegasus mail forensics, inaccessible messages also provide lot of important clues which can bring about up twist in case of litigation. If crucial messages about the company have been swapped to some other parties or competitors then recovering the deleted messages can provide culpable evidence. To find out whether there are any messages deleted from Pegasus mail, forensic investigators can simply perform re-indexing of that folder from Pegasus. Folders in Pegasus email application get saved in .mbx format. But sometimes critical situation arises where you need a solution to view Pegasus mail in different email application.
You are Outlook user and having important .mbx files on your system which are corrupted or inaccessible due to a reason. Now you are confused and continuously looking for a solution which can quickly open and read Pegasus mail. Because according to forensics, such deleted or corrupted Pegasus mail can contain crucial information which could be a big evidence for them.
To overcome from the following situation, you can download commercial third party utility which allow to open, view and read Pegasus mail files in a single attempt. Moreover, such type of applications are so easy to use that it can be easily accessible by anyone.
Steps to view Pegasus Mail
Once you followed the steps described above, now you can easily view Pegasus mail with attachments without any difficulty and with exact formatting and metadata properties.
Use the above given information and perform the required tasks within seconds. And also described the role of Pegasus in forensics. And provide the tips which will tell you about what to do in the situation when Pegasus mail folders became inaccessible and how to view them.