Tips To Simplify Entourage Forensics Procedure

MailXaminer | May 9th, 2015 | Forensics

Entourage is an email client for Mac Operating System, developed by Microsoft. It was first introduced in the year 2000 as a part of MS Office Suite 2001 for Mac OS 8.5 and above. Entourage included the basic functionality for emailing, calendar and scheduling, contact management, creating notes etc. just like any other efficient emailing service. With Entourage 204, there was support for Project Center that offered way for organizing projects.

How Entourage Stores its Database?

The Entourage mail account data gets saved into Microsoft’s Proprietary Database format. Depending upon version of Entourage used, it gets saved at standard location:

Entourage 2001:



Entourage X:



Entourage 2004:



Entourage 2008:





How Multiple Mail Accounts are Managed:

For more than one mail account configured with Entourage, the concept of creating multiple Identities is followed. These identities can be used to access emails, contacts, calendars, and tasks in separate environment on single machine. For log in to different accounts, users can switch identities but it is disappointing as a part of security that there is no option to password protect an identity.

The Info Stored in Mailing List:

A mailing list in Entourage forensics is like a distribution list that is generally used for discussion with multiple recipients. Through the mailing list manager, it is ensured that the messages from names defined in the list will never go to the spam folder.



Microsoft Entourage Forensics on Windows OS:

For collecting Entourage messages into a simplified email format, the idea is to archive the message folders into MBOX file. For this, an easy drag-and-drop method will work.

  • Resize the Entourage window and create a folder on desktop.
  • Select the mail folder that you wish to archive as MBOX. If there is no folder list in the pane, then click on “Folder List” available under the “View” menu.
  • Drag the folder and drop it to the folder created on desktop. For every mail folder, MBOX file can be created. However, if the root folder is selected, its sub folders would not be included in archiving process.

The idea of archiving the messages as MBOX helps in easy examination of mails as a number of eDiscovery tools support analysis of MBOX file which is a text file with email data stored in it. More than that, there are specialized MBOX File Viewer freeware available that aid in opening and examining mails.



Entourage Database Forensics on Windows:

For an all-inclusive archive of Entourage database including emails, calendars, notes, tasks, and contacts, the Export option in the application can be utilized. The Entourage archive (.rge) file can be investigated on Windows Operating System.



The mail folders will be saved into MBOX file only. So if .RGE folder is exported on Windows, it will save the mail folders into .mbox file which can be opened using MBOX viewer.

For opening contacts, calendars, tasks, and notes, text editor programs can be used. The data for folders will get saved into generic file extension (or you can simply say that it has no extension). There is no program that can open such file but its contents can be at least read in text editor.

Contact in Entourage:



How to Read it on Windows:



Calendar in Entourage:


How to Read it on Windows:



Entourage Data Deletion and Related Facts!

Just like any other database or file system, data deletion from Entourage removes only the index entry and for the deleted item from the mailbox, a hole (also called free space) gets created in the database. This space will remain in the database until it is overwritten by the new data. For manually overwriting these holes, the database can be compacted following which the original disk space will be restored and the DB will reduce in size.

When it comes to restoring emails deleted from Entourage, we can take help of server settings. If Microsoft Entourage email forensics is configured with Exchange Server, a lot of things can be simplified. For example, the data after deletion will got to dumpster where it will be preserved for some days before it finally gets purged.

In scenarios where Exchange Server is working in collaboration with Entourage database forensics, a lot of help can be acquired through Exchange database investigation. Restoring deleted mailboxes and data can be done through data saved on Server.

Email Investigation against Forgery:

Testing email for spam or against forgery is one of the important part of Microsoft Entourage forensics. Although a lot of information can be availed through the internet email of header, a lot of figures remain untouched like testing pornography, filtering emails, checking it in different ways etc. To complete Entourage database forensics, the procedures are now days accompanied by tools like MailXaminer that help in carving out artifacts from mail files saved on desktop and web mail database.