Since the release of Mac OS X, Mail.app has been the default email application. Mail stored emails in .mbox files up until the release of Mac OS X Tiger 10.4, at which point Apple changed the default file type to .emlx. The instructions below outline the process used to recover and investigate the contents of these formats.
When looking for email on suspect Mac OS X drive, the standard location for the stored email is ~/Users/"USERNAME"/Library/Mail
You can use either the Analyze or Salvage functions of MacForensicsLab to examine Mail files.
- To use the Analyze function, use search query of ".mbox" for systems from Mac OS X 10.0-10.3 and ".emlx" for Mac OS X 10.4 Tiger and 10.5 Leopard.
- When using the Salvage function, direct the search to ~/Users/"USERNAME"/Library/Mail and do a Salvage of that location. Both .mbox and .emlx files will automatically be found.
