Search & filter
Pinpoint relevant messages with filters for subject, sender, dates, body text, and attachment details.
Email examination · Windows desktop
Softaken Examiner
Windows job-based email examination—add evidence, browse and search indexed mail, review communication patterns, then export scoped packages from one workspace.
Bring intake, review, analysis, and reporting into one focused workspace for analysts, IT teams, and investigators. Examine data only with proper authorization.
Evidence intakeSHA-256 verifyIndexingSearch & filterMessage reviewReport & export
Message preview
See the message body, headers, properties, and attachments together before making a finding.
Export
Turn selected messages and artifacts into clear reports or structured export packages.
Windows desktop
Work with authorized data in a Windows desktop workspace designed for controlled review.
Main capabilities
Start with a case, follow the evidence trail, and keep every important review step in one place.
Case management
Keep the case brief, evidence list, processing status, notes, findings, reports, and exports together.
Evidence intake
Bring in mail files, folders, or an acquired mailbox and see what has been registered, verified, and indexed.
Integrity records
Capture and recheck SHA-256 values, follow application handling events, and review the operation history.
Timeline & communication
See activity over time, compare sender and recipient relationships, and focus on the communication pairs that matter.
Reports & findings
Mark important artifacts, add context, and turn your review into a focused case report.
Derived exports
Share structured CSV or JSON data and selected-artifact packages with the context needed for review.
Browse mail stores
Open an indexed mail store, move through its folders, and inspect the message details without losing the surrounding context.
- Navigate inbox, sent items, contacts, calendar, and related folders
- Compare subjects, senders, recipients, and message details in one view
- Inspect body content, properties, attachments, raw headers, received hops, MIME structure, and hashes
- Move from a selected message to deeper analysis without leaving the case
Search indexed evidence
Start broad, narrow the results with practical filters, and open the exact item that needs attention.
- Separate emails, contacts, calendar items, tasks, attachments, and extracted data
- See the result type and the field that produced the match
- Open the detail pane to understand the result before acting on it
- Inspect, bookmark, or add a finding directly from the result
Send a useful result set to CSV, Excel, JSON, HTML, or PDF output for the next stage of review.
- 1Add evidence
- 2Index
- 3Browse
- 4Search
- 5Export
Communication analysis
Turn a large mailbox into a readable picture of people, pairs, and message activity. The view reflects loaded evidence, not live monitoring.
- Map observed sender and recipient pairs with message counts
- Jump from a relationship to the supporting emails behind it
- Rank top senders and recipients with clear volume charts
- Move from communication patterns to timeline and message-level review
Link map
Visualize observed traffic between addresses in the indexed job.
Volume charts
Rank senders and recipients with message counts and date ranges.
Top senders and recipients
Use the rankings to decide where to look next, then validate the pattern against the underlying messages.
Evidence and export
Choose the evidence scope, select the artifacts, and create a package that another reviewer can open and understand.
Export scope
Package a complete source, selected search hits, or a short list of artifact IDs.
Package contents
Keep the original email, attachments, extracted text, OCR text, metadata, hashes, manifests, and dossier HTML together.
Discovery resources
Use these official resources for installation, licensing, support, and evaluation requests.
Practical use cases
Use Examiner when a mailbox or document collection needs more structure than manual folder-by-folder review can provide.
Corporate investigations
Review an authorized mail collection for policy, incident, data-loss, or internal-risk questions.
Incident response
Connect headers, dates, attachments, URLs, and IP references while building an incident timeline.
Compliance review
Preserve the evidence inventory, record observations, and give reviewers a clear report trail.
Mailbox handover
Inspect PST, OST, EML, MSG, MBOX, EMLX, or mail folders before an approved migration or handoff.
Document examination
Bring PDFs, Office documents, and images into the same review process and inspect their metadata.
Focused evidence export
Move from search hits to a clean package containing the messages and supporting artifacts a reviewer needs.
Product screenshots
Click any capture to enlarge.
Coverage and requirements
Technical information
Here is what the application is built to handle across intake, review, analysis, and reporting. Confirm edition-specific limits before a production examination.
Platform & processing
- Platform
- Windows desktop application
- Workspace
- Case folder containing the database, indexes, working data, reports, and exports
- Processing
- Local case processing for authorized supplied or acquired data
- Integrity
- SHA-256 capture and re-verification
Evidence support tiers
- EML, EMLX, MSG, MBOX/MBX, PST, OST, and supported mail folders
- Documents
- PDF, DOCX, XLSX, PPTX, JPG, and PNG extraction or OCR
- Containers
- TGZ/tar.gz unpacking followed by child processing
- Legacy
- Some DOC, XLS, PPT, and NSF sources may have limited or best-effort coverage
Review & analysis
- Browse
- Folder tree, message or document list, body, headers, properties, and attachments
- Search
- Keywords, phrases, people, dates, attachments, URLs, IPs, OCR text, and evidence scope
- Analysis
- Timeline, communication pairs, sender/recipient charts, domains, URLs, IP inventory, and review queues
- Annotations
- Bookmarks, tags, notes, and findings associated with reviewed artifacts
OCR, reports & export
- OCR
- Supported images and scanned PDFs; default size limit: 32 MiB
- Reports
- Case summary, evidence and integrity, findings, custom, and email dossier reports
- Formats
- CSV, JSON, HTML, and PDF output from the relevant report or export workspace
- Packages
- Selected evidence, attachments, metadata, hashes, provenance manifest, and dossier output
Clear processing status: Exception logging identifies files that need another look, so you can separate complete results from items requiring manual review.
Version note: Confirm exact support tiers, controls, and licensed output options with Softaken for your installed edition.
Comparison
A practical comparison for teams moving from manual mailbox review to a repeatable examination process.
| Task | Manual review | Softaken Examiner |
|---|---|---|
| Find by sender or keyword | Per-folder client search | Search and filter in one workspace |
| Headers and attachments | Varies by client | Dedicated preview panes |
| Export subset | Manual copy | Scoped export package workflow |
| Review record | Separate notes and copied files | Case notes, findings, reports, and export manifest |
| Legal certification | Requires your procedures | No built-in legal certification |
Clear answers before you begin
Frequently asked questions
Straight answers to the questions teams usually ask before starting an examination.
What is Softaken Examiner?
Softaken Examiner is a Windows desktop case workspace for registering authorized email and related evidence, indexing supported content, searching and reviewing artifacts, documenting findings, and creating reports or exports.
What is the typical Examiner workflow?
Create a case, add evidence, capture or verify hashes when required, index supported sources, browse or search the indexed content, review findings, and create a report or export. Check exceptions and coverage before relying on a result.
Can I examine a mailbox without authorization?
No. Examine only data you are authorized to access. Softaken Examiner supports technical review of supplied or acquired data and does not bypass authentication or organizational access controls.
Which formats and sources does it support?
Examiner works with EML, EMLX, MSG, MBOX or MBX, PST, OST, mail folders, common PDF and Office documents, images, and selected container or legacy formats. Support level varies by source type; contact Softaken for your edition.
Does Examiner support OCR?
Examiner can extract text from supported images and scanned PDFs through OCR. OCR output is automated text, so compare important wording, names, and numbers with the original source.
Why can a search return no results?
An empty result does not always mean the content is absent. Confirm that the relevant evidence is indexed, review Partial or Skipped statuses and Exceptions, check OCR coverage, and broaden filters before drawing a conclusion.
What integrity information can the application record?
When enabled, the application can capture and re-check SHA-256 values for registered source files. Chain of Custody and Audit Log record application-level handling and operations; they do not replace external custody procedures.
Does Softaken Examiner monitor a live mailbox?
No. Communication views and message counts reflect the evidence loaded into the case. They are for reviewing indexed material, not for live mailbox monitoring or ongoing traffic capture.
Can I inspect a message before creating an export?
Yes. Browse or search the indexed evidence, open the detail view, inspect the message and related artifacts, and then select the evidence scope for a report or export.
What should I do when processing coverage is partial?
Review the Partial or Skipped statuses and Exceptions, confirm which sources and artifacts were indexed, and manually review any material that was not processed before reaching a conclusion.
What can I export from Softaken Examiner?
You can create CSV or JSON data exports, HTML or PDF reports, and selected-artifact packages containing attachments, metadata, hashes, provenance, and dossier output. Available formats depend on the selected workspace and license.
Is an exported report legal or forensic certification?
No. Softaken Examiner provides technical review and reporting support. Legal admissibility, authenticity, authorship, identity, custody requirements, and investigation conclusions require qualified professional judgment and applicable procedures.
How do I request an evaluation or user guide?
Use the Request Evaluation form on this page to ask Softaken about licensing, evaluation access, or the user guide for your edition.
Request evaluation
Ask Softaken for Examiner licensing, demo access, or the user guide for your edition. We respond using the contact details you provide.
- For Windows desktop examination workflows
- Use only data you are authorized to access
- Same secure submission as the main contact form
Softaken Examiner
Request access, licensing details, or the user guide and see how Examiner fits your review process.
