Free Email Forensics Tools: 5 Free Viewers and Other Useful Tools
Blog Overview: Free email forensics tools help you inspect email files, examine email headers and review digital evidence without immediately using or inspecting in full forensic platform. As emails are vulnerable to various types of email threats, right tool will depend on what needs to be investigated from examining a suspicious message to managing larger collection of evidence.
In this guide we will cover two groups this helps simplify email examination process:
- Five free viewers for MBOX, OST, PST, EML and MSG files.
- Thirteen other open-source or free email forensics tools that support email analysis and digital investigations.
Note: These five free viewers in first group are developed by MailXaminer team and are free for download. The 13 tools in second group are made by other companies and we will link each tool’s own site.
Email investigations are not new for digital forensic investigator. However, due to the increase in the number of email applications, it becomes challenging to be equipped with right set of tools that are agile, offering an abundance of features that can deliver accurate and dependable results. There are numerous software programs, most of them are paid, which is not budget-friendly.
As a result, it is not feasible for an investigator to obtain a utility for examining emails of different files. Therefore, as an alternative, there are various freeware solutions available for different email types.
Freeware Email Examination Utilities
Here are the most demanding softwares that are list below for you:
1. Free MBOX Viewer
In case the custodian has suspected emails in MBOX format, then MBOX Viewer would be best-suggested software to view emails and their respective headers. This tool supports MBOX files of all major MBOX supported email applications such as Thunderbird, Entourage, AppleMail, Eudora, Pocomail, The Bat, Turnpike, Chaos Mail, Spicebird email, Earth Link, MailCopa, etc.
It can also recover if MBOX is corrupt and generate a preview of the same. The email content can be viewed in different preview options, which include Mail view, Hex view, Properties view, Message Header View, MIME view, HTML view, RTF view, and Attachments view. Additionally, the software is designed to support .mbox files, regardless of the file size.
2. Free OST File Viewer
This tool is feature-rich email examination software to examine an offline Outlook storage table (OST) that is disconnected from Exchange Server. This standalone utility enables us to examine all data items associated with the OST file. This includes emails, contacts, calendars, tasks, notes, journals, etc.
It is efficient enough to scan and open a damaged OST file using the Advanced Scan option. Moreover, it ensures to preserve the read/unread email message status in the software panel. Multiple files can be scanned at one shot and previewed with all the items, including attachments. Besides this, the installation of Microsoft Outlook is not required to view and examine OST files for forensic investigation.
3. Free PST File Viewer
When an investigator need to view and investigate emails and other data items out of a PST file. Then, Outlook PST File Viewer is ultimate rescue. This software can preview entire PST data items like emails, contacts, calendars, tasks, notes, etc. without Outlook installation.
One can easily arrange or sort emails according to different attributes such as From, To, Subject and Received. A preview is generated for emails in multiple styles and deleted suspect emails can be recovered by availing Advance Scan mode. It also allows saving scanned file from the corrupted PST file. Using the attachment view, it allows to avail of various options like Zoom In, Zoom Out, and Rotate Attachment File.
4. Free EML File Viewer
EML file is another commonly encountered email-based file format by the forensic investigators. EML is an acronym of email, which is supported by numerous email clients. This includes Thunderbird, Windows Mail, Windows Live Mail, Outlook Express, etc. The software provides an option to auto-locate and uploads the EML files from the software panel itself.
With help of EML File Viewer, analyzing the email headers is made easy as it provides detailed information on the emails. It provides 7+ preview modes such as Mail View, Hex View, Properties View, Message Header view, etc. By availing these options, the investigating officer can effortlessly investigate the potential data from the .eml files.
5. Free MSG File Viewer
Many times, investigators come across a challenging situation i.e., to examine email header of MSG files. For that, MSG File Viewer is perfect yet result-oriented solution. The software is induced with the best set of features to seamlessly open and examine MSG files for email analysis. The software is designed to auto-locate the folder consisting of MSG files directly to the software panel.
It renders multiple preview mode options to thoroughly examine the files. MSG Files are the individual message files containing messages exchanged over MS Outlook. It is an independent application, which does not require MS Outlook installation to open a read MSG file. Besides this, it facilitates searching keywords within Outlook PST file using various search criteria.
System Requirements for Free Viewers
Before downloading any free email examination tools listed above, ensure your computer meets minimum system requirements. These tools are designed for users to view and examine different email file formats without separate paid examination tool for each format.
System Requirements:
- Operating System: Microsoft Windows 11 (64-bit), Windows 10, 8, 7 (32 bit or 64 bit) & Windows Server 2019, 2016, 2012 R2, 2008
- RAM: 2 GB Recommended
- Desktop: DDR2, DDR3, DDR4 (up to 3200 MT/s), DDR5 (up to 4800 MT/s)
- Additional: LPDDR4X (up to 4266 MT/s), LPDDR5X (up to 9600+ MT/s)
- Architecture: Fully compatible with traditional and Unified Memory structures.
- Free Disk Space: 100 MB Available Space Required
- Legacy/Standard:Hard Disk Drive (HDD) / Solid-State Drive (SSD)
- High-Speed: PCIe SSD / PCIe NVMe M.2 SSD
- Form Factor Note: Compatible with all internal desktop and laptop drive types
- Processor: Intel®: Core™ 2 Duo E4600 @ 2.40 GHz or higher (Compatible with Core i / Core Ultra series)
- AMD: Ryzen™ 3 1200 @ 3.10 GHz or higher (Compatible with Ryzen / Ryzen AI series)
- Qualcomm®: Snapdragon™ X X1-26-100 or higher (Plus / Elite architectures – Windows on ARM64)
Other Free Email Forensic Software and Supporting Tools
Following free tools and utilities can support different parts of an email investigation. Some are open-source email forensics tools, others help with:
- Evidence extraction
- Metadata inspection
- File conversion
- Broader Digital Forensic work.
They are not all dedicated email analyzers. Choose according to the goal you want to achieve.
| Tool | Type | Platform (Verify) | Best For |
|---|---|---|---|
| Autopsy | Open-source forensics platform with graphical interface. | Windows, Linux and macOS builds exist | Keyword searching and broader case work |
| Bulk Extractor | Digital evidence extraction tool | Linux, Window, macOS | Finding addresses and strings in disk images |
| CAINE | Linux based digital forensics environment | Bootable 64-bit Linux | Setting up forensic environment for evidence acquisition and examination. |
| emlAnalyzer | Command-line EML analysis | Python-based installation depends on environment | Headers, MIME, structure, attachments and links in single messages. |
| ExifTool | Metadata reader | Windows, macOS, Linux | Metadata of attachments and images |
| FTK Imager | Previews and images drives without changing the original and creates hash values. | Windows | Previewing and acquiring evidence, calculating hashes |
| Google Admin Toolbox Messageheader | Web-based header analyzer | Browser | Routing and delivery delays |
| libpff | Library and command-line tools for Outlook data | Cross platform (source) | Scripted access to Outlook data. |
| Plaso (log2timeline) | Timeline builder | Linux, Windows, macOS | Placing events for sources in order. |
| readpst (libpst) | PST converter | Linux and macOS: Windows ports exist. | Moving PST data into other workflows |
| SIFT Workstation | Forensic and incident response toolkit | Linux | Broader investigations |
| The Sleuth Kit | File system and disk image tools | Cross-platform | Examining file systems and images |
| Wireshark | Network traffic analyzer | Windows, macOS, Linux | Reviewing captured email-related network traffic. |
How Investigator Should Choose Among These Tools ?
Start with evidence you have and what is your goal. If your goal is to inspect saved message, choose viewer or message analyzer that supports its format. Investigating delivery information is your goal use header analyzer. If your work involves multiple evidence sources. Search across a case, or consider broader forensic platform.
How To Handle Email Evidence Carefully
If email is used in formal investigation, preserve original file and work from appropriate copy. Record even small details like where evidence came from and what actions were performed. Hashes can help identify weather examined file has changed, but hash alone cannot prove that an email is authentic.
- Header information
- Attachment metadata
- Analysis results
These can provide useful leads. They should be interpreted with rest of the evidence rather than treated as proof of a sender’s identity or intent.
What To Do When More Comprehensive Investigation Workflow is Needed?
Free viewers and individual utilities are useful when an investigator have specific task to perform. If investigator want to:
- Examine larger collections of email evidence.
- Search across supported formats.
- Review attachments.
- Correlate findings.
Professional email forensics software offers broader investigation capabilities, including case management, advanced search and filters, OCR-based attachment search, and timeline and link analysis.
The Closing Words
This blog has clearly described the top 5 free email examination software, which supports examining files from various email applications. All these software incorporates advanced features that will allow an investigator to easily examine the various attributes associated with the email header. As a result, the investigating officers can efficiently understand the motive behind sending spam or spoof emails and help in finding the culprit.
Frequently Asked Questions
Q: Can free email forensics tools recover deleted emails ?
A: Some tools can recover deleted items through supported mailbox files, but success depends on file format, available data, and extent of corruption or deletion. Recovery is not guaranteed.
Q: How can one analyze suspicious email for free ?
A: Use an email header analysis tool like MailXaminer and inspect routing information and available SPF, DKIM, and DMARC results. User can examine links and attachments safely, and treat findings as indicators rather than proof of malicious activity.
Q: Are free email forensics tools reliable for formal investigations ?
A: They can support small investigations, but suitability depends on tool and case requirements. Preserve original evidence, work from copy, document your steps, and verify file integrity using cryptographic hashes where appropriate.