Evidence Search in EMLX File Format Using Digital Forensic Tool

EMLX is a mail message file format used to store a single email message in Mac operating system. It is also known as the Apple Mail email file because it is typically created by Apple/Mac Mail. EMLX consists of data files rather than documents or media because it just contains plain text. So, it can be viewed using any text editor and it can be opened in the Windows operating system.

Mac OS X Apple Mail use standard MBOX file format to store email messages. MBOX contains Apple Mail emails using a single EMLX file per email message format, that is, .emlx file extension. It is easy to edit and manage the email messages but exporting these message files becomes harder.

View EMLX File in Apple Mailbox

In Apple Mail, each message is kept individually in an EMLX file format instead of storing the email messages in a mailbox. To locate the mailbox in your Mac system, go to the “menu bar” then, go to the folder and enter –

“ ~user/Library/Mail/Mailboxes/

Here, you will get the mailbox. Click on the mailbox > message, and you will see all the emails with .emlx file extension.

Local folders of each mailbox contain two directories. For example, if a folder is named as “Draft” then there will be two directories Draft.mbox and Draft.sbd. The directory with .sbd extension is the subdirectory which contains only subfolders without messages. And .mbox file contains the messages. The individual EMLX files are stored within each mailbox folder. In which each email message is saved separately with .emlx file extension.

Evidence Extraction from EMLX File Format in Digital Forensics

In digital forensics, email data is a great source to extract evidence. But the examination of email data is a difficult process because there are numerous email clients along with their supported email file formats. Analysis of EMLX file extension is useful in the case of Apple Mail message data. EMLX files can access using any text editor. Evidence extraction during the investigation is quite difficult using text editors. Their aren’t enough features to execute a perfect investigation. MailXaminer Email Examiner Software provides an efficient solution to analyze and extract evidence from the EMLX file.

This Email Forensics Tool provides a wide variety of advanced features to analyze email data. Tool supports 20+ file formats used by different email clients. This forensic software is designed in such a way that it can be easily used by a layman as well as a forensic examiner. User just needs to create a case, add the data source, and then start the examination process in a systematic way using its amazing features.

Add EMLX File in The Software

The tool provides the option to add the email files with various different file formats which is compatible with various different email clients. To add the EMLX file into the tool to examine the email data and extract the evidence. Click on the Add New Evidence button, then choose the EML/EMLX from the add file window and add the data file with EMLX file format.

 

Preview Email Data from EMLX File

EMLX file format is compatible with text editors. So, users can access these files with the help of text editors like Notepad, MS Word, Notepad++, etc. But during the forensic investigation, sometimes investigators need to extract evidence in different aspects. For that, this forensic tool provides the option to preview EMLX file format in different views such as Message, Attachments, Properties, Message Header, MIME, HTML, RTF,  and HEX. Each view gives different information related to the email message which helps to analyze emails with different aspects.

 

View and Analyze Attachments

Using this Email investigation tool users can view and analyze all attachments of data files within the email file. Users can select the Attachment tab in the email preview section and view the attachments in the email message. It saves time of the examiner while examining the images and attachments of the emails.

 

Find Evidence with Powerful Search Mechanism

This tool features an advanced search algorithm that helps to fetch out the required data just by entering some related keywords. While examining the large data files, examiners face issues to find some specific data. The email forensic tool provides a powerful search mechanism that helps examiners to analyze and extract evidence systematically. It provides various search options with different search algorithms such as General Search, Proximity Search, Regular Expression, Stem Search, Fuzzy Search, and Wildcard Search.

 

Export EMLX Evidence Report

After the examination process, user can export and download evidential reports in the desired file format. It provides different file format options such as EML, MSG, HTML, PDF, etc. Users can save the report in any of the file formats at the desired destination.

 

Conclusion

Apple Mail in Mac operating system generates the EMLX file format. This file format stores the single mail message of Apple Mail rather than the entire mailbox data. Users can easily access the EMLX file using any text editor because it is a data file, which contains textual data. The above featured software is a remarkable Digital Forensic Tool that helps investigators to examine the EMLX files in different views and extract all information related to the email data.