Skip to content
Krellix

Documentation

Everything you need to run a defensible collection.

These pages cover the full life of a Krellix collection: signing in, scoping the query, running the export, understanding what lands on disk, and verifying the chain of custody. If something is missing, tell us — documentation gaps are a bug.

Start here

Getting started

What Krellix does, what the two modes are, and the fifteen-minute path from download to first export.

Setup

Personal setup

For solo operators collecting their own correspondence. Sign in, scope a collection, and ship.

Enterprise setup

For operators collecting from another custodian in their tenant. Includes the admin consent flow and the Add-MailboxPermission step.

Understand the output

Seven-folder export structure

What lands in each of the seven folders, in the order a reviewer should open them.

Verify a collection

The step-by-step for re-hashing files and re-validating the RFC 3161 timestamp — no Krellix license required.

Operate

Troubleshooting

The errors operators actually hit: AADSTS90094, permission 403s, TSA timeouts, corrupted manifests, and how to resolve each.