Hi All,
I have a E01 image of a Mac OSX Server 10.6 Snow Leopard from which I wish to extract the email stores for the users.
I have been able to identify the email stores and have noted there location under
[root]/macintosh HD/private/var/spool/imap/dovecot/mail/
From there each of the mail boxes is under the users GUID.
The mail boxes are stored using the opensource dovecot.
I don't have much experience with dovecot but in drilling down I think the emails are store in MIME with base 64 encoding for the attachments.
I am ideally wishing to extract the emails into a more common format for review by investigators or legal teams.
As such I would like to export the email into a common processing container format such as mbox.
Does anyone have any ideas?
Hi all just to close this off I have be able to solve the problem using a tool Aid4Mail.
Thanks for following up with your solution. It is helpful.