As of February 2022, Vault changed the format of the metadata file from XML to CSV. S

Hello <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-ur

<a href="https://github.com/Nuix/Associate-Google-Vault-Data/files/9767693/GmailTestEx

Hello <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-ur

Hi Jason, I think maybe someone might have found that , but wasun

Hi Jason, I actually figured out the Annotate-From-CSV . The only

Actually I think I have this integrated into the existing now. <p dir="auto

New Google Vault Metadata File Format (Gmail) about associate-google-vault-data HOT 11 CLOSED

nuix commented on September 25, 2024

New Google Vault Metadata File Format (Gmail)

from associate-google-vault-data.

Comments (11)

JuicyDragon commented on September 25, 2024

Hello @jerrycrosbytt, do you by chance have any examples you might be able to share with me? I no longer have access to a Google account that I can run vault exports from.

from associate-google-vault-data.

jerrycrosbytt commented on September 25, 2024

GmailTestExport.zip
Hi @JuicyDragon please see the attached file. Will look exactly like a regular Gmail export, but with a metadata.csv instead of metadata.xml as before. Seems that some environments have taken that Feb 2022 Vault update and others not. Thanks!

from associate-google-vault-data.

jerrycrosbytt commented on September 25, 2024

Also, appears as if Google fixed one problem but not completely. The Rfc822MessageId field in the metadata.csv does not 100% match the Message-ID brought in from the .mbox, as shown below.

Rfc822MessageId
CAK85mn=66XohJq6SoYWyH1-=[email protected]
CAK85mnkggm7S_OknYUSFKTsxs6d=[email protected]

Message-ID
CAK85mn=66XohJq6SoYWyH1-=YBfJOAz8m1qTycgc0WAOpTwQow@mail.gmail.com
CAK85mnkggm7S_OknYUSFKTsxs6d=HEywPMSqRbczayUagwymLQ@mail.gmail.com

from associate-google-vault-data.

jerrycrosbytt commented on September 25, 2024

Hi Jason, thanks for your message, and I uploaded sample files to github. If there is another script that is a simple CSV overlay (that we've been unable to find), please let us know. thanks! *Jerry Crosby* Forensics - Converged Security Investigations TikTok Inc, 200 Massachusetts Ave NW, Washington DC, 20001 703.593.9873 Email: ***@***.*** From: "Jason ***@***.***> Date: Wed, Oct 12, 2022, 11:37 AM Subject: [External] Re: [Nuix/Associate-Google-Vault-Data] New Google Vault Metadata File Format (Gmail) (Issue #2) To: "Nuix/Associate-Google-Vault-Data"< ***@***.***> Cc: ***@***.***>, "Mention"< ***@***.***> Hello @jerrycrosbytt <https://github.com/jerrycrosbytt>, do you by chance have any examples you might be able to share with me? I no longer have access to a Google account that I can run vault exports from. — Reply to this email directly, view it on GitHub <#2 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3RYD5FBFK6JKGL7MPLF4Z3WC3LJ5ANCNFSM6AAAAAARCNWSYA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

from associate-google-vault-data.

JuicyDragon commented on September 25, 2024

Hello @jerrycrosbytt , thank you for sending that. I hadn't really thought about that, but if a CSV overlay does the trick that could be a relatively simple path forward. I wonder if this script may meet your needs:

https://github.com/Nuix/Annotate-From-CSV

from associate-google-vault-data.

jerrycrosbytt commented on September 25, 2024

Hi Jason, I think maybe someone might have found that script, but was unclear how to set it up so that the rpc... Field matches up to a version of the message-ID field, maybe without the <'s and >'s. I should have taken the scripts course before I left Nuix in July! ;) *Jerry Crosby* Forensics - Converged Security Investigations TikTok Inc, 200 Massachusetts Ave NW, Washington DC, 20001 703.593.9873 Email: ***@***.*** From: "Jason ***@***.***> Date: Thu, Oct 13, 2022, 4:55 PM Subject: [External] Re: [Nuix/Associate-Google-Vault-Data] New Google Vault Metadata File Format (Gmail) (Issue #2) To: "Nuix/Associate-Google-Vault-Data"< ***@***.***> Cc: ***@***.***>, "Mention"< ***@***.***> Hello @jerrycrosbytt <https://github.com/jerrycrosbytt> , thank you for sending that. I hadn't really thought about that, but if a CSV overlay does the trick that could be a relatively simple path forward. I wonder if this script may meet your needs: https://github.com/Nuix/Annotate-From-CSV — Reply to this email directly, view it on GitHub <#2 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3RYD5ANAY7XXOZU4O4QW63WDBZLNANCNFSM6AAAAAARCNWSYA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

from associate-google-vault-data.

jerrycrosbytt commented on September 25, 2024

Hi Jason, I actually figured out the Annotate-From-CSV script. The only thing I'll have to do is see if I can make some text edits on the fly on the CSV so it adds in the correct header row, and modifies the <'s and >'s for the Message-ID field. If you have a good script example that shows lots of text modifications, please let me know. thanks! *Jerry Crosby* Forensics - Converged Security Investigations TikTok Inc, 200 Massachusetts Ave NW, Washington DC, 20001 703.593.9873 Email: ***@***.*** From: "Jason ***@***.***> Date: Thu, Oct 13, 2022, 4:55 PM Subject: [External] Re: [Nuix/Associate-Google-Vault-Data] New Google Vault Metadata File Format (Gmail) (Issue #2) To: "Nuix/Associate-Google-Vault-Data"< ***@***.***> Cc: ***@***.***>, "Mention"< ***@***.***> Hello @jerrycrosbytt <https://github.com/jerrycrosbytt> , thank you for sending that. I hadn't really thought about that, but if a CSV overlay does the trick that could be a relatively simple path forward. I wonder if this script may meet your needs: https://github.com/Nuix/Annotate-From-CSV — Reply to this email directly, view it on GitHub <#2 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3RYD5ANAY7XXOZU4O4QW63WDBZLNANCNFSM6AAAAAARCNWSYA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

from associate-google-vault-data.

JuicyDragon commented on September 25, 2024

Actually I think I have this integrated into the existing script now.

AssociateGoogleVaultData_v1.12.0-preview1.zip

There is now a new script in addition to the original script:

The XML version is the original script and the CSV version is the new bit. Given the sample you provided (thanks again for that) this looks to be working pretty well. Please give it a go and let me know if it appears to be working well for you also. If things look good, I'll turn this into an official release 😄

from associate-google-vault-data.

jerrycrosbytt commented on September 25, 2024

Oh super nice Jason, will try tomorrow. One change i noticed is for the original # prefixed fields like #To and #From. These are not # prefixed in the csv. That might not be a problem, but will find out tomorrow. Thanks! *Jerry Crosby* Forensics - Converged Security Investigations TikTok Inc, 200 Massachusetts Ave NW, Washington DC, 20001 703.593.9873 Email: ***@***.*** From: "Jason ***@***.***> Date: Thu, Oct 13, 2022, 6:33 PM Subject: [External] Re: [Nuix/Associate-Google-Vault-Data] New Google Vault Metadata File Format (Gmail) (Issue #2) To: "Nuix/Associate-Google-Vault-Data"< ***@***.***> Cc: ***@***.***>, "Mention"< ***@***.***> Actually I think I have this integrated into the existing script now. AssociateGoogleVaultData_v1.12.0-preview1.zip <https://github.com/Nuix/Associate-Google-Vault-Data/files/9781035/AssociateGoogleVaultData_v1.12.0-preview1.zip> There is now a new script in addition to the original script: [image: image] <https://user-images.githubusercontent.com/11775738/195722752-d6141faa-fb5e-44fe-8a33-54293d024714.png> The XML version is the original script and the CSV version is the new bit. Given the sample you provided (thanks again for that) this looks to be working pretty well. Please give it a go and let me know if it appears to be working well for you also. If things look good, I'll turn this into an official release 😄 — Reply to this email directly, view it on GitHub <#2 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3RYD5DVIZU4MUHRVRROMWDWDCE47ANCNFSM6AAAAAARCNWSYA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

from associate-google-vault-data.

jerrycrosbytt commented on September 25, 2024

Hi Jason, Works great! Thanks for setting this up! Will help lots of clients who will have that February 2022 update done for Gmail. We're anticipating Google will do the same change from XML to CSV at some point. I guess we'll deal with that when it happens. Only one thing that we'll change: In the GmailCsvParser.rb_ it is appending "Gmail_" onto the field names, and we'll just remove that. No biggie. Thanks! Jerry *Jerry Crosby* Forensics - Converged Security Investigations TikTok Inc, 200 Massachusetts Ave NW, Washington DC, 20001 703.593.9873 Email: ***@***.*** From: "Jason ***@***.***> Date: Thu, Oct 13, 2022, 6:33 PM Subject: [External] Re: [Nuix/Associate-Google-Vault-Data] New Google Vault Metadata File Format (Gmail) (Issue #2) To: "Nuix/Associate-Google-Vault-Data"< ***@***.***> Cc: ***@***.***>, "Mention"< ***@***.***> Actually I think I have this integrated into the existing script now. AssociateGoogleVaultData_v1.12.0-preview1.zip <https://github.com/Nuix/Associate-Google-Vault-Data/files/9781035/AssociateGoogleVaultData_v1.12.0-preview1.zip> There is now a new script in addition to the original script: [image: image] <https://user-images.githubusercontent.com/11775738/195722752-d6141faa-fb5e-44fe-8a33-54293d024714.png> The XML version is the original script and the CSV version is the new bit. Given the sample you provided (thanks again for that) this looks to be working pretty well. Please give it a go and let me know if it appears to be working well for you also. If things look good, I'll turn this into an official release 😄 — Reply to this email directly, view it on GitHub <#2 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3RYD5DVIZU4MUHRVRROMWDWDCE47ANCNFSM6AAAAAARCNWSYA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

from associate-google-vault-data.

JuicyDragon commented on September 25, 2024

Excellent! Glad to hear it.

from associate-google-vault-data.

New Google Vault Metadata File Format (Gmail) about associate-google-vault-data HOT 11 CLOSED

Comments (11)

Related Issues (1)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent