Hello together,
within last days I got a lot of Mac devices (only god knows why) and for almost every case I do have to export E-Mails. I do work with X-Ways Forensics, so exporting .emlx files and converting them to .eml is not the problem. But due to the amount of mails I can only export them into one folder to convert them from there. So you won't know instantly if this E-Mail used to be in Ingoing, Outgoing a.s.o. and due to the circumstance that the attachments are stored in a separate folder you might now get them too.
I tried to export the whole email folder and imported it in Thunderbird with ImportExportTools but it didn't work. There is no separate mbox.-File since a specific version of Mac OS X.
So I tried a second solution - logging into the account and use the export function (in a vm of cause). But the account is password protected. I found the hashdata and running hashcat, but this might take a while - so I was think replacing the hashdata with a custom made one or setting auto login to true or whatever - but I didn't found a solution here too.
So what I'am going to ask is
1. Does someone know a good method to export this .emlx files in a "sober" way, to read it with Thunderbird or whatever tool?
2. Does somebody how to log in to the user profile?
3. Do you know a generator for the mac based pbkdf2 hash algorithm (it's like the general one but with some specifications).
Thank you very much for your help and let me know if you need some more informations!
Semi-random thought, mind you, but if you have a folder containing (say) thousands of .eml (plain text) files wouldn't be easier to post-process them by simply selecting them according to the "From" field (the outgoing ones would all have the same sender) and then move the outgoing ones to a new folder?
I am not familiar with MAC originated .eml's but on windows the attachments are "inside" the .emls, Base64 encoded, or is the separate file created by the conversion? ?
jaclaz
Yes of course, I could do some powershell or whatever - but I would still miss some attachments.
Since a specific version of Mac OS the attachments are stored in separate folders, but in some cases you get the attachments anyway - strange behaviour -)
Does anyone have another solution? Especially for the password / auto login …
you could do something like adding the emails to report tables for Inbox, outbox, etc then when you recover\copy, use the group by feature to keep things organized.