Scrutinize Evidence by Reading MBOX Files
Published on 03 November 15
Shweta3
Electronic mode has given investigators a vast of scope for investigation. Email file investigation has also grown recently and has become prime field for interpreting the proofs. Knowledge of different file formats is extremely necessary when the case is associated with any desktop email client. MBOX file format being a common storage file format, investigators come across such cases where these files are involved in ceased data. Locations of the files, integrity of file, structure, readability, platform needed for reading MBOX files are some of the necessary elements investigators have to ruminate about when it is part of examination.
Analyze Structure to Open MBOX File on Windows
MBOX file format is a generic form for all associated file formats, which are primarily used for storing collection of emails in a sequential manner primarily implemented for UNIX edition. MBOX file is structured as a completed mailbox with emails concatenated and saved as plain text in single file. Every Email is started with From_line and ends with a blank line. Its linear sequence of email message makes it convenient for storing but while analyzing this does not help at all. To open MBOX file on Windows user should know that it has several variants like: .mbx, .mboxcl, mboxcl2, mboxrd, etc. depending upon the email client using it for storage of emails.
This format is used for the storage but has not been formally defined through RFC standardization. mbox (RFC 4155) mailbox message is stored in their Internet Message (RFC 2822) which can be directly accessed by users. Many email applications support this MBOX file format like: Eudora, Claws Mail, Evolution, Mozilla Thunderbird, Netscape, Pegasus, SeaMonkey, etc. Alternative to MBOX format for network-email storage system is maildir mailbox format.Challenges Faced While Reading MBOX Files
-· Availability of Supporting Email Client: MBOX file is not accessible without any supporting email client. Investigators will need platform, which supports and reads this file format. Any of the email clients, which stores emails in same format, can be used as a platform.
-· Different Work Stations: If investigators are using different workstation where file is not supported, it can cause a trouble to open MBOX file on Windows. In such case, also examiners need a platform, which can support variants of MBOX.
-· Systematic Representation for Examination: Mere reading MBOX files with text content will not help for complete examination. Experts need a mode using which the emails can be viewed in systematic matter along with the attachments.Access MBOX Files Without Supporting Email Client
In order to access MBOX files, it has to be imported in the MBOX-supporting email clients and then users can read the emails in it. However, due to challenges faced by cyber officials, it is better to opt for a standalone medium for analyzing the content of MBOX file.
To open MBOX file on Windows utility like MBOX file viewer is suitable option for the MBOX investigation. The application is capable to perform analysis on MBOX file emails and the associated Meta and attachments. With several views like; Hex, Properties, MIME, RTF, Message Header, etc. This platform is available for all the versions of Windows and investigators are capable to perform the MBOX forensics in any Windows version.
http://www.acquireforensics.com/products/free/mbox-viewer/
Free MBOX Viewer utility to open & read MBOX file. View Eudora & Thunderbird emails using free MBOX file viewer/reader without any environment dependency.
This blog is listed under
Development & Implementations
Community
Related Posts:
Click this link http://www.thebestcomparisons.com/mbox-to-pst.html and read the MBOX to PST Converter software reviews.
For a quick solution to view MBOX file of different mail client, you can also try to use a Kernel for MBOX Viewer software. It is a very advanced and FREEWARE tool that can easily open MBOX file without dependency of Mail client. To get more visit http://www.nucleustechnologies.com/mbox-viewer-free.html
One of the best utility available in the market to extracting and converting emails from MBOX file to multiple email format.It provides you with a stop solution for successful conversion of MBOX files into Apple Mail, Entourage, Thunderbird or Power mail in Outlook PST file created importable perform. Read more details:- http://www.filesrecoverytools.com/mbox-to-pst-converter.html