Hi,
I am making my first post on this part of the forum, I am a phone examiner but have a computer question!
How do you guys deal with .emlx files?
I have imaged an iPhone and exported the mail database. I have then used Emailchemy to parse the emails out into their native .emlx format.
My colleague has shown me that Encase enables you to open the .emlx files in document view and you can then print these to PDF for example. But there must be an easier way to present these e-mails? This is not ideal to do if you have more than a few!
I welcome all advice!
Warm Regards
Hi Doug,
Have a look at this, cheap and cheerful, does attachments too.
http//
The output includes a summary listing so the client can quickly preview your results.
(disclaimer my software)
Doug,
If you open the .emlx file with a text editor and save the file with an eml extension, Outlook Express will open the file and present the data correctly. I guess you could then acquire the eml file folder using FTK Imager, import into FTK and produce a standard HTML report.
This would be time consuming but I suppose you could rename all the emlx files to eml files using a DOS command 'rename *.new *.old'.
.
I've found that EMail Detective will also handle MAC / Apple emlx files without a problem. It's a low cost solution for exporting them to standard eml files.
Cheers,
Art
P.S.
Their product can be found here
If you have "single file" emlx emails in EnCase (I assume version 7), make a logical evidence file of them and then run the evidence processor selecting just emlx email against the LEF.
From "Records" tab you should be able to bookmark the email and produce a report.
Bookmark them into the email bookmark folder and the report template should be able to read the contents and populate a report with all your email.
You have the option then to save the report as a PDF, rtf or HTML.
Hello,
I have had and continue to have great results with Aid4Mail Forensic, which does handle Mac .EMLX files (http//
Regards,
Larry