Point in Time Email Export

[mcbride]

Long time member, but first post in the new platform! We have a situation where we need a point in time email export of a user's inbox to provide to another non-technical user to maintain for a period of time so they can search it if/when needed. The user who's inbox we're talking about is still an active employee so we cannot use TakeOut if it exports the contents to another account/user. I know we could use mbox, but that isn't the most user friendly and not the best for searching. Is there another option I'm missing?

[Bill_Gibson]

Would it make sense for person B be added as a delegate to person A's mailbox?
May introduce other interpersonal 🚩, but it would be a great user experience for person B

[mcbride]

Sometimes the best ideas are the ones overlooked...lol...I didn't even give Delegate access a thought. It may not be appropriate in this situation, but I'm going to at least give that some consideration!

[Michael_Roop]

I’m waiting for the day we can spin up a virtual with PrivateGPT on it and no connection outside of the virtual.  Then we can submit the mbox logs and once they are a database, we can use AI prompts to pull information….  Then when done, just nuke it….

[Kim_Nilsson]

Delegated Gmail, as suggested by @Bill_Gibson is the absolute best solution for the person who needs access. It is however not a point in time access, as the second person has access until it is removed.

The two alternatives are:

1. Give investigator access to Vault. Very complicated for the investigator, and you run the risk of doing something wrong, rendering the investigator having access to everyone's content.

2. Export the relevant data and giving it to the investigator.

2a. Export with Vault to MBOX and installing MBOX Viewer on the investigator's Windows computer. That viewer is fairly easy to use. When investigation is completed, all files can be deleted.

2b. Export all emails with GYB and inject them into a separate "investigation account" (only used for this purpose), and give the investigator delegated access to that  investigation account instead. Delete that account when done.