Extract Evidence from Outlook PST File into EML Format

MailXaminer | October 21st, 2020 | Forensics

EML is the file extension used to save single mail message file containing header, message & attachments. It provides support for non-text attachments & non-ASCII character sets as it follows MIME format.

In digital forensics, the basic purpose to export the file into EML file format is archiving & sharing the message as an attachment file across the web. As the .eml file only contains single email data, hence it helps to protect the confidentiality of other data.EML is RFC 822 standard format which provides an easy to use within a large number of email clients, servers & applications. Extract PST file into EML format to open and share Outlook email files in other email clients. It is the best solution that helps investigators to save and examine Outlook email data through different platforms that support .eml file format.

How EML File is Different from PST File Format?

EML files are the individual e-mail message files that contain a plain text file format which gives results as a standard file structure. EML file consists of a short header having sender, recipient, subject, date & time, and the body having the main message. EML file format is unlikely less complicated than PST file format, as it has got user friendly key features given below.

  • EML follows a multipurpose Internet mail extensions format.
  • It supports non-text attachments, non-ASCII character sets & message bodies having multiple parts.
  • It has a wide range of accessibility as it supports Windows OS as well as Mac OS.
  • Users can view the content of .eml file with most of the e-mail clients like Outlook Express, MS Outlook, Apple Mail, Mozilla Thunderbird, etc.
  • One can open directly in different web browsers like Internet Explorer, Mozilla & Opera by re-naming the extension to “.mht” from “.eml”.
  • Notepad or text-editor can be used to open and view EML files.

Examine Outlook Database File Format via MailXaminer

As we know, Outlook stores the mailbox information in .pst file format, but sometimes users save their information in an encrypted format. The hidden formation cannot be read by the user in normal view mode, as it needs specific viewers i.e. Hex Viewer. During the investigation, first, the investigator needs to detect the state of the file, whether it is healthy or corrupted. For this, the Email Forensics Tool MailXaminer can be used to find the actual state and hidden contents of the evidence file by using its multiple integrated viewers.

To know more about, how data is stored in PST file format, please visit:

https://www.mailxaminer.com/blog/outlook-2013-email-forensics/

After analyzing the evidential data from the PST file, investigators can create a report of different parameters stored within the file, by using the ‘Export’ feature of the tool. If the investigator wants to save all the email files stored in PST file format into a single message EML file format, it is possible with MailXaminer. It provides EML and MSG to save details in a single message file format.

In the below section, we have discussed how an investigator can examine and save the PST file information into EML file format using MailXaminer.

Examine Outlook PST Files in Different Views

The tool allows investigators/examiners to open and analyze Outlook PST files during the email investigation. It provides different preview modes for emails such as Normal Mail, Hex, Properties, Message Header, MIME, Email Hop, HTML, RTF, and Word Cloud. Through each view, users can find different information related to each email message.

Examine Outlook PST Files

Select Specific Mail to Save in EML Format

Instead of saving the entire email file in EML format. The tool provides the option to selectively choose desired email files from the mailbox, which needs to be exported and saved in EML file format.

Selective Outlook PST File into EML Format

Export Options in MailXaminer

Conversion of email data to various file formats is possible through the “Export” option of MailXaminer. After selecting the desired emails to export, choose the “EML” option to export PST file into EML format.

Extract Evidence from Outlook PST File into EML

Folder Selection for Conversion in EML Format

When there is a situation for exporting a complete folder instead of specific emails as an EML file, then you can use the bulk export option of MailXaminer. Follow the given process to convert bulk emails of Outlook PST folder into EML format.

Export Option: The bulk conversion of PST to EML format is possible through the “Export” button of MailXaminer. It allows converting the selected email folders or an entire folder of PST file to EML format.

Export Option

Save Selected Mailbox Information in EML File: Through the “Export” option in MailXaminer, the desired folder can be selected to convert PST to EML format. After the folder is selected, choose the EML option to export the PST file into EML format.

Save Selected Mailbox Information in EML File

Additional Export Settings: While exporting PST files into EML format, the tool provides additional export options like “Export Setting, Naming Convention, CSV/Header Settings, etc.” During the Naming Convention, it provides multiple naming options for the exported file.

Additional Export Settings

Conclusion

EML file format is used to export and save a single email message file. In digital forensics, EML format helps its users to archive or share data of a single email message without affecting its confidentiality and original formatting. Thus, the Digital Forensic Tool MailXaminer can be used to examine and export the Outlook PST file into EML format in a risk-free manner.