Skip to main content
日本語 简体中文 繁體中文

[Email DLP] How to Retrieve a Message Source

Question

How can I obtain the information required for investigating HENNGE Email DLP?

Answer

The methods for obtaining each type of information are as follows.
If you are unsure which information to obtain, please contact HENNGE One Technical Support.

* We recommend providing Files in .eml format.
If you provide Files in other formats, email data may not be analyzed correctly for certain investigations.

Microsoft 365

Procedure for obtaining recipient header information in Microsoft 365

  1. Open the relevant email from the recipient's "Inbox."
  2. Click "… (More actions)" in the upper-right corner of the Message Preview screen, and then select "View message details" under [View].
  3. Select and copy all text displayed on the page, paste it into a text editor, Save it, and provide the saved Files.

Procedure for checking Microsoft 365 email logs

Refer to the following article provided by Microsoft Support to search for the Delivery Status of the relevant email, and provide a screenshot of the Details in the Showing results.
Run a message trace and view the results (External link)

Procedure for obtaining .eml Files from OWA (Outlook on the Web)

  1. Access OWA from a PC browser.
  2. Open Setup (the gear icon in the upper-right corner of the screen), and under [Layout] - [Message organization], select [Show email as individual messages] and Save the setting.
  3. Open the Target location, right-click the relevant email in the email list, and click ［Downloader］－［Download as EML］.
    ・For sent emails: [Sent Items] 
    ・For received emails: [Inbox]
  4. Please provide the downloaded Files.

Procedure for obtaining .eml Files from the Outlook app

  1. Open the Outlook app.
  2. Double-click the Target email to open it in a new window.
  3. Click [Save As] from the ellipsis (…) in the upper-right corner of the Email body.
    * Do not use the ellipsis in the bar at the top of the screen.
  4. On the [Save As] screen, select [Email Message] as the type of Files and Save them.
  5. Please provide the downloaded .eml Files.
Google Workspace

Procedure for obtaining the message source in Gmail

・Sent emails

  1. Open the relevant email from the Sender's [Sent Mail].
  2. Click [︙(More)] in the upper-right corner of the screen, and then click [Download message].
  3. Please provide the saved .eml Files.

・Received emails

  1. Open the relevant email from the recipient's [Inbox].
  2. Click [︙(More)] in the upper-right corner of the screen, and then click [Download message].
  3. Please provide the saved .eml Files.

Procedure for checking the headers of received emails in Gmail

  1. Open the relevant email from the recipient's [Inbox].
  2. Click [︙(More)] in the upper-right corner of the screen, and then click [Show original].
  3. A page containing the header text will be displayed.

Procedure for obtaining Google Workspace audit log information

Refer to the following article in Google Workspace Administrator Help to search for the Delivery Status of the relevant email,
and provide a screenshot of the Details in the Showing results.
Email Log Search (External link)

Common to Google Workspace / Microsoft 365

Procedure for obtaining emails from HENNGE Email Archive

Refer to the following article in the Help Center, obtain the relevant email, and provide it.
[Email Archive Classic] Is it possible to download the searched archive mails?

Procedure for obtaining data through reproduction verification (investigation using HENNGE Email DLP)

* Data can be obtained from either the Administrator Console or the Users Console.

Prepare a Suspend Rule in HENNGE Email DLP in advance to obtain reproducible data.
If you are unsure of the Procedure, HENNGE One Technical Support can prepare it for you. Please request Setup assistance.

  1. send a reproducible email, match it to the verification Rule, and Suspend the email.
  2. Select [My suspended emails] or [Team suspended emails] under [Suspension], and click the relevant email.
  3. Open the relevant email and obtain a screenshot showing information from the subject through Size.
  4. Obtain the .eml Files using the Downloader button to the right of the email subject.
  5. Discard the email without sending it.
    * It will not be sent to the Recipients.
  6. Please provide the screenshot obtained in Procedure 3) and the eml Files obtained in Procedure 4).

Translation Disclaimer

This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.

In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.