WholeClear Investigator | Windows Email Forensics Software

Evidence Inventory & Deep Indexing

Add evidence. Index deeper. Know what the case contains.

Build a case-wide inventory of supported email, mailboxes, documents, images, folders, and archives. Hash with SHA-256, verify integrity, and index supported content. Track skipped and failed items in the same list.

Task: Add email, folders, mailboxes, and other supported evidence sources.Outcome: Review each item alongside its category, size, support level, integrity status, and index state.
Task: Hash, verify, and index evidence before review.Outcome: Understand which items have been processed, which remain unverified or unindexed, and where further investigation is needed.
Task: Filter evidence and inspect failed or skipped items.Outcome: Keep incomplete processing visible and make informed decisions about the next investigative step.

WholeClear Investigator case-wide evidence inventory showing added items, integrity status, indexing progress and processing results — Case-wide evidence inventory showing added items, integrity status, indexing progress, and processing results.

Supported Email & Evidence Sources

Bring supported email and digital evidence into one case.

Add supported email files and mailboxes—including PST, OST, EML, EMLX, MSG, and MBOX—alongside supported documents, images, folders, and archives. Organize added items in a unified evidence inventory, with indexing and integrity status available for review.

Email formats

Primary evidence types for mailbox and message review.

PSTOSTEMLEMLXMSGMBOXMBXNSF

OST is parser-dependent. NSF needs an installed Notes client — see NSF requirements.

Documents

PDFDOCXXLSXPPTXDOCXLSPPT

PDF, DOCX, XLSX and PPTX document examination. DOC, PPT and XLS are legacy formats with HEX preview only.

Images

JPGJPEGPNGGIFWEBPBMPTIFTIFF

JPG, JPEG, PNG, GIF, WEBP, BMP, TIF and TIFF. OCR is available when enabled for the case.

Folders

EMLEMLXMSG

Folders containing EML, EMLX or MSG files can be added. Each file keeps its own format and processing status.

NSF / Lotus Notes

NSF support requires an installed HCL Notes or IBM Notes client with the required COM integration. Encrypted or ACL-protected NSF files may require a compatible Notes ID file and password. NSF support is best effort and parser dependent; it is not a standalone forensic binary reader.

Support level and index state are shown per item. Adding a file to the inventory is not the same as deep-indexing its content.

Email Evidence Examiner

Inspect the message. Explore every evidence view.

Review supported email files in a unified workspace. Read message content, inspect attachments and properties, analyze available headers and routing hops, and examine MIME, HTML, RTF, URLs, hashes, and raw message data—all from the same email item.

Task: Open an email and examine its content, structure, headers, and available technical evidence.Outcome: Move between readable message content and detailed technical views without opening separate tools for every inspection step.

Investigator email evidence examiner with folder tree, message list, body preview and header, hops, MIME and hash tabs — Email evidence examiner — message content and technical views on the same item.

Indexed Search & Triage

Search beyond simple keywords.

Search indexed and successfully processed content using keywords, exact phrases, AND, OR, NOT, wildcards, field filters, proximity queries, fuzzy matching, regex patterns and date-from/date-to filters. Extracted-text hits stay labeled as derived data.

ANDORNOT"exact phrase"* ?NEAR/nfrom / to / subjectdate range

Task: Search indexed message content, people, and attachments.Outcome: Narrow the case to relevant messages and searchable extracted or OCR-derived text.
Task: Use field-aware queries, Boolean logic, phrases, and date ranges.Outcome: Limit results to the query you meant, instead of a single keyword dump.
Task: Review ranked hits, excerpts, and processing coverage.Outcome: See why a result matched and keep derived search hits separate from original evidence.

Results depend on indexing and processing status. Skipped, failed, unsupported or partial content may not appear. An empty result is not proof that content is absent.

Investigator indexed search with keyword, field-aware and extracted-text results labeled as derived data — Indexed Search — field-aware queries across indexed messages and extracted text, with match excerpts and processing coverage.

Forensic Email Analysis

Map email relationships. Open the messages behind every connection.

Explore communication relationships across indexed email. Review sender and recipient connections, message counts, available To/Cc/Bcc context, and activity details. Select a relationship to locate its supporting messages and continue the investigation without losing context. The graph shows relationships observed in indexed messages — it does not by itself prove identity, intent, or that two people actually communicated.

Task: Select a connection in the communication graph.Outcome: Review relationship details and locate the associated messages.
Task: Investigate a sender or recipient.Outcome: Follow communication patterns and narrow the review to relevant email addresses.
Task: Export the communication graph.Outcome: Include a visual relationship summary in case notes and reports using supported export formats.

Investigator communication graph showing observed email-address relationships and supporting messages for investigation — Communication graph showing relationships between email addresses and the supporting messages available for investigation.

Sender & Recipient Analysis

Identify the most active email addresses in the case.

Rank senders and recipients by message count to understand communication volume across indexed email. Search for a specific address, change the sort order, and export both rankings for case notes and reporting. Message count is an activity indicator — it does not by itself establish a person’s involvement, importance, or wrongdoing.

Task: Rank senders and recipients by message count.Outcome: Identify frequently appearing email addresses before reviewing individual messages.
Task: Search for a specific email address.Outcome: Check whether an address appears in the indexed email collection.
Task: Export sender and recipient rankings.Outcome: Save a visual summary of communication volume in a supported PNG or PDF format.

Investigator top senders and recipients ranked by message count for communication-volume analysis — Top Senders & Recipients — Rank email addresses by message count, search for specific participants, and export communication-volume summaries for case documentation.

Forensic Export & Production

Package evidence for review. Keep hashes and provenance with the export.

Export all evidence, selected search hits, or specified evidence items into an organized case package. Include supported email files, attachments, extracted documents, OCR text, metadata, SHA-256 hash records, a provenance manifest, and a dossier report. The package holds exported copies and supporting records — not a substitute for the original source files. OCR text and extracted content stay labeled as derived data, separate from original-format evidence copies. Hash records cover the items actually hashed; the provenance manifest records available evidence IDs, source references, and export details.

Task: Export the full evidence set or selected items.Outcome: Create a structured package containing the requested evidence copies and supporting records.
Task: Include SHA-256 hashes and provenance details.Outcome: Give reviewers hash records and source references to support integrity checks and evidence traceability.
Task: Generate a dossier report for review.Outcome: Provide a structured summary of the exported items and their available supporting information.

Investigator evidence export workspace for selecting evidence copies, hash records, provenance details and a dossier report — Evidence export workspace — select evidence and supporting records, then generate an organized package with hash records, provenance information, and a dossier report.

Email forensics and eDiscovery workspace features

What you actually see in the Windows workspace. Export options still follow the active licence.

OCR and extracted text

See what the engine could read. Extracted hits stay labeled so they never stand in for the source file.

Audit, custody and exceptions

Audit log, chain-of-custody view, and exception list record what ran, what failed, and what never finished.

Timeline and attachments

Open Timeline from the sidebar. Review attachments on a message or as a search filter.

How Investigator documents evidence integrity

The source file is hashed with SHA-256 and a working index is built locally. The export package can include hashes.csv and a provenance manifest for examination context.

Ingestion	Read-only of the source file. Supported email stores include PST, OST, EML, EMLX, MSG, MBOX, MBX, and NSF where the Notes client is available. Indexes stay in the local case directory.
Hashing	SHA-256 capture and verify in the inventory; hashes.csv in the export package.
Message forensics	RFC 5322 header, hops, transit IPs, URLs, MIME, HTML, RTF, bytes, and hashes.
Search	Keywords, exact phrases, AND/OR/NOT, wildcards, field filters, proximity, fuzzy, regex, and date range — across indexed and successfully processed content.
Analysis	Communication graph, top senders and recipients, Timeline sidebar.
Records	Integrity view, chain-of-custody view, audit log, and processing exceptions.
Export	Working copies, metadata, OCR text, provenance manifest, dossier report, plus CSV, Excel, JSON, HTML, and PDF.
Platform	64-bit Windows desktop. Confirm the minimum Windows version against the installer notes. Evaluation installer on request — not the public converter.

Software Specifications

Investigator specifications for the current desktop build

Version 1.0. Full and Demo editions ship as separate installers. Features, formats, and export behavior follow the installed edition and licence. Confirm deployment details against the installer notes for your build.

Application

Desktop application for authorized digital evidence examination.
Current application version: 1.0.
Full and Demo editions are distributed separately.
Supported features, formats, and export behavior depend on the installed edition and licence.

Operating system and architecture

Current installer target: 64-bit Windows.
The bundled engine is self-contained. A separate .NET Runtime installation is not required.
Confirm the minimum Windows version against the final release test matrix for your installer.

Memory and storage

RAM depends on evidence size, indexing scope, OCR workload, and concurrent processing.
Free storage is required for the application, case database, working copies, extracted content, logs, and exports.
No fixed minimum RAM or disk figure is published for this build.

Supported evidence and mail formats

EML, EMLX, MSG, MBOX, MBX — supported examination workflow.
PST — supported indexing, search, and folder browsing.
OST — best effort and parser dependent; some files may fail to parse.
Mail folders containing EML, EMLX, or MSG — supported per-file workflow.
PDF, DOCX, XLSX, PPTX — document examination and available text/metadata extraction.
JPG, JPEG, PNG, GIF, WEBP, BMP, TIF, TIFF — image examination; OCR when enabled.

NSF / Lotus Notes requirements

NSF support requires an installed HCL Notes or IBM Notes client with the required COM integration.
Encrypted or ACL-protected NSF files may require a compatible Notes ID file and password.
The current implementation uses Notes COM and needs the 32-bit Notes-compatible environment.
NSF support is best effort and parser dependent; it is not a standalone forensic binary reader.

Archive and container handling

TGZ and TAR.GZ container extraction.
ZIP and NUPKG may be inspected when found as nested evidence containers.

Search and examination

Keyword and exact-phrase search across indexed and successfully processed content.
Boolean operators AND, OR, NOT; wildcards * and ?; proximity NEAR/n.
Field-aware search including from, to, subject, OCR, native, attachment, and PII fields.
Fuzzy and regular-expression queries, plus date-from and date-to filters.
Results may exclude skipped, failed, unsupported, or partially indexed content.

Processing and reporting

Evidence indexing, search, and inspection.
OCR coverage visibility where OCR is enabled and available.
Processing logs, warnings, and exceptions.
Timeline, communication, and relationship views where supported by the case data and release build.
Reports and exports depend on the active edition, licence, and processed case data.

Windows desktop compatibility

The current installer targets 64-bit Windows. Confirm the minimum Windows version against the installer notes. Format conversion is a different product — use the public converter download.

Converter download Support

Licensing and evaluation

Ask for the evaluation build if you want to run Investigator on a sample matter. The Demo can cap items, workspace life, or export. The Full build activates in-app.

Request Investigator evaluation Converter activation

Frequently asked questions

What is WholeClear Investigator?

Investigator is Windows desktop software for email forensics, digital evidence review, and eDiscovery workflows. Examiners can review supported email stores, inspect message headers and attachments, search indexed content, analyze communication relationships, and export evidence copies with associated hash records and provenance information.

Who is it designed for?

Digital forensic examiners, corporate investigation teams, eDiscovery reviewers, incident response professionals, and organizations that need structured email evidence examination and reporting.

Which email file formats are supported?

Supported email formats include PST, OST, EML, EMLX, MSG, and MBOX, subject to the capabilities and limitations of the relevant import and processing modules. Processing depth may vary by format and file condition. Review the supported-format documentation or request an evaluation for your specific evidence sources.

Can I add documents, images, folders, and archives as evidence?

The evidence inventory includes supported documents, images, folders, and archives. Processing, extraction, and indexing depend on the file type and module. Unsupported or failed items should be reviewed in the inventory and exception records.

Can I inspect complete email content and technical details?

The examination workspace shows available message content and technical views, including headers, routing hops, attachments, properties, MIME, HTML, RTF, URLs, and raw message data where the source format supports them. What you see depends on the original item and its parser.

Can I search across large mailboxes and attachments?

Indexed search covers successfully processed messages, people, attachments, and available extracted or OCR-derived text. Queries may use keywords, exact phrases, field-aware filters, Boolean operators, wildcards, proximity, regex, and date ranges. Review index status, processing exceptions, and any result limits. An empty result is not proof that the content is absent.

What is the difference between indexing and deep indexing?

Indexing prepares supported content and metadata for search and review. Deep indexing may examine additional supported content or derived data, depending on enabled processing. Depth varies by format, configuration, and file condition. Check the index state and processing results for what was actually examined.

Can I analyze email communication patterns?

Communication analysis visualizes relationships between email addresses and sender or recipient activity across indexed messages. You can inspect available message counts, header context, and supporting messages. Those relationships describe the indexed data; they do not independently establish a person's identity, intent, or wrongdoing.

How are SHA-256 hashes used?

SHA-256 values can be recorded for supported evidence items and included in an export package. Verification compares available data against a recorded hash under the applicable workflow. A match supports a finding that the hashed data matches the recorded value; it does not independently establish authenticity, completeness, or legal admissibility. See the disclaimer.

Does exporting evidence modify the original files?

Export is designed to create derived copies under the selected export or case location rather than rewrite source email files. Verify the workflow and destination settings before processing. Preserve original evidence separately under your organization's procedures.

What is included in an evidence export package?

Depending on selected options and available data, a package may contain evidence copies, attachments, extracted content, OCR text, metadata, SHA-256 hash records, a provenance manifest, and a dossier report. Actual contents depend on selected items, processing results, and export settings.

Can I export search results and investigation reports?

Evidence export and reporting workflows are available. Outputs may include structured packages and formats such as CSV, Excel, JSON, HTML, or PDF, depending on the particular export function. Review the options in your installed version.

Does the software guarantee court admissibility?

No software can guarantee that evidence will be admitted in court. Admissibility depends on applicable law, collection procedures, integrity controls, documentation, and case circumstances. Follow relevant legal requirements and organizational forensic procedures. See the disclaimer.

Which operating systems are supported?

Investigator is a Windows desktop application intended for supported Windows 10 and Windows 11 environments, subject to current system requirements and edition compatibility. Confirm a particular Windows build or deployment configuration if needed.

Is Investigator the same as the standard converter?

No. Investigator is for investigation, evidence review, indexed search, and forensic-oriented export. The public converter evaluation is a separate product. Request the Investigator evaluation if you need that workspace.

Is an evaluation available?

Yes. Request an evaluation to confirm availability, duration, included features, licensing terms, and system requirements before deployment.

Does the software upload evidence to the cloud?

Investigator is a Windows desktop application. Local processing depends on the relevant workflow. Review current privacy documentation and configuration to confirm whether any feature uses network services. For sensitive investigations, validate network behavior in your environment before processing evidence.

Where can I get technical support?

Use the Contact Us page for supported-format questions, installation, evaluation, licensing, or technical issues. Include the application version, Windows version, relevant error details, and the affected workflow. Do not send confidential evidence unless an approved secure transfer process has been arranged.

Platform	64-bit Windows desktop
How you get it	Installer issued after this form
Case items	Limited in Demo
Workspace	May expire with the Demo
Export	May be limited in Demo
Source mailbox	Left untouched
Public download	Converter only — not Investigator

Email Forensics & Digital Evidence Investigation for Windows