Evidence Search in EMLX File Format Using Digital Forensic Tool

MailXaminer | January 23rd, 2019 | Forensics

EMLX file format is a Mail message file used to store single email messages in Mac operating system. They are sometimes called as Apple Mail email files because they are typically created by Apple/ MAC mail. EMLX is a data file rather than document or media because it just contains plain text. So that it can be viewed using any text editor even it can open in the Windows operating system.

Mac OS X 10.4 onwards Apple Mails stop using standard MBOX file format to store email messages. Instead of MBOX, it starts to use a propitiatory single file per email message format. That is the EMLX file extension. This makes the job to handle the email messages simple even though the exporting process become harder.

View EMLX File In Apple Mailbox

In Apple Mail instead of storing the email messages as a mailbox each message is stored individually as EMLX file format. To locate the mailbox of Apple Mail follow the path given bellow:

“ ~user/Library/Mail/Mailboxes/[mailbox]

Local folders of each mailbox contain two directories. For example if the folder named Draft then there will be two directories Draft.mbox and Draft.sbd. Where directory with the SBD extension is the subdirectory which contains only subfolders without messages. And MBOX files contains the messages. The individual EMLX files are stored within the message folders of each MBOX. In which each mail messages will be implemented as separate EMLX file extension. Which helps to access each message separately.

Evidence Extraction From EMLX File Format In Digital Forensics

In Digital Forensic forensic analysis of email data is the great source of evidence. But the examination of email data is a difficult process because of the different file format and supported email client. Analysis of EMLX file extension is useful in the case of Apple Mail message data. Even though EMLX extension can open by any text editor. Evidence extraction during the investigation can’t be done properly through that. MailXaminer provides an efficient option to extract analyse evidence from the EMLX file.

Add EMLX File In MailXaminer

Add EMLX file into MailXaminer tool to examine the email data and to extract the evidences. Choose the EML/EMLX(*.eml,*.emlx) from the add file option to add the EMLX file format.

Preview Email Data From EMLX File

EMLX file extension is one of the file which supported by the text editors. That is it can be open and view by using the text editors like “Notepad, MS Word, Notepad++” etc. Because it is a data file which contains only the textual data. But during the Forensic investigation, it needs to extract evidence in different aspects. For that this forensic tool provides the option to preview EMLX file format in different views such as “Mail, Properties, Hex, Message Header, HTML, RTF, MIME, Email Hop, Attachments”. Each view gives different information related to the email message.


EMLX file format is generated by Apple Mail in Mac operating system. This file format is used to store the single mail message of Apple Mail rather than the entire mailbox data. EMLX file extension can open and view using any text editors because it is a data file, which contains textual data. MailXaminer is dependable Digital Forensic Tool which helps the investigators to examine the EMLX file in different views and extract all information related to the email data.