Simplify Entourage Forensics Procedure in Different Versions

MailXaminer | January 22nd, 2021 | Forensics

Entourage is an email client developed by Microsoft for Mac Operating System. It was introduced in the year 2000 as a part of MS Office Suite 2001 for Mac OS 8.5 and above. Entourage is similar to any other efficient emailing service wherein it provides functionality for calendar, scheduling tasks, contact management, creating notes, etc.

How Entourage Stores its Database?

The Entourage email data saves into Microsoft’s Proprietary Database Format. It depends upon the version of the Entourage used. The standard location to save the Entourage database:

Entourage 2001:

Entourage 2001

Entourage X:

Entourage X

Entourage 2004:

Entourage 2004

Entourage 2008:

Entourage 2008:

Multiple Mail Accounts in Entourage

The concept of creating multiple identities is followed to configure more than one email account with Entourage. These multiple identities can be used to access emails, contacts, calendars, and tasks in a separate environment with a single machine. To login to different accounts, users can switch identities. But, the part of security regarding the Entourage email client is disappointing as there is no option available for the protection of identity password.

Information Stored in Mailing List:

A mailing list in Entourage forensics is like a distribution list that can be generally used for discussion with multiple recipients. Through the mailing list, it is ensured that messages from names defined in the list will never go to the spam folder.

Entourage Forensics Procedure

Microsoft Entourage Forensics on Windows OS

For collecting Entourage messages into a simplified email format, the idea is to archive the message folders into an MBOX file. For this, an easy drag-and-drop method will work, as follows:

Step 1: Resize the Entourage window and create a folder on the desktop

Step 2: Select the mail folder from Entourage that you wish to archive as MBOX. If there is no folder list in the pane, then click on “Folder List” available under the “View” menu

Step 3: Drag the folder and drop it to the folder created on the desktop.

For every mail folder, an MBOX file can be created as followed. The idea of archiving the messages in MBOX format helps in the easy examination of emails. Because the email forensic tool supports the analysis of MBOX files containing text files with email data.

Entourage Database Forensics on Windows

For all the inclusive archival data of the Entourage database including emails, calendars, notes, tasks, and contacts, the Export option in the application can also be utilized. The Entourage archive (.rge) file can be investigated on Windows Operating System. For this, users have to archive the email folder into .mbox file format. If the .rge folder will be exported on Windows, it will save the mail folders into a .mbox file which can be easily examined using the Email Forensics Software MailXaminer.

Windows Entourage Database Forensics

Entourage Data Deletion and Related Facts!

Just like any other database or file system, data deletion from Entourage also removes the index entry and deleted items from the mailbox. A hole (also called free space) gets created in the database. This space will remain in the database until it is overwritten by some new data.

When it comes to manually restore emails deleted from Entourage, we can take the help of server settings. But, with the help of Microsoft Entourage email forensics software, a lot of things can be simplified. For example, the data after deletion will get to trash, where it will be preserved for some days before it finally gets clear out.

In such scenarios, where Exchange Server is working in collaboration with Entourage Database Forensics, a lot of help can be acquired through Exchange database investigation. Restoring deleted mailboxes and data can be done through data saved on server using the email forensic tool MailXaminer.

Email Investigation Using Entourage Email Forensic Tool

Testing emails for spam is one of the important parts of Microsoft Entourage forensics. Although a lot of information can be availed through the internet email of the header, a lot of figures remain untouched like timeline and link analysis, filtering emails using advanced searches, and checking it in different ways, etc. To complete Entourage database forensics, the procedures are nowadays accompanied by tools like MailXaminer that help in carving out artefacts from mail files saved on desktop and webmail database.

View Email in Different Preview Modes:

During the investigation process, users can view scanned emails into various preview modes. The tool provides 9+ preview modes including the Message Header view. It can be used to deeply analyze the header information of the email in order to extract the evidence from it.

Different Preview Modes

Link and Timeline Analysis to Analyze Suspected Data:

The email forensic tool has features of link and timeline analysis. These can be used to find the connection and relation between the users of suspected emails.

Link Analysis: During the investigation process, the link analysis feature can help investigators to display the pictorial representation of the connection between users. It helps to make the analysis process convenient.

Entourage Forensics Link Analysis

Timeline Analysis: It can be used to analyze the flow of data in a graphical form. Using this, investigators can easily view and examine the email data exchanged within the specific Date, Month, and Year.

Entourage Timeline Analysis

Search Evidence using Advanced Searches:

While investigating a large amount of data, users can avail facility of advanced searches available in the software. The tool provides various advanced search algorithms such as General Search, Proximity Search, Regular Expression, Stem Search, Fuzzy Search, and Wildcard Search. Investigators can use these searches to find the required data systematically without wasting extra effort and time.

Advanced Searches for Entourage Forensics


Email Forensic Software, MailXaminer is an efficient forensic software that can be used to examine the email data of various email clients. Entourage is the email client for Mac OS. In order to analyze Entourage email data, firstly user needs to archive its mailbox data into an MBOX file which can be easily examine using MailXaminer software. The advanced features of the software help investigators to extract the evidence systematically and conveniently.