Comments on Computer Forensics, Malware Analysis & Digital Investigations: EnScript to convert individual OSX .emlx files int...

Many institutions limit access to their online inf...

2010-06-17T05:17:16.145-07:00

Many institutions limit access to their online information. Making this information available will be an asset to all.

Hi Lance, Have you been able to work on adding th...

2010-01-01T23:46:27.389-08:00

Hi Lance,

Have you been able to work on adding the ability to reassemble the emlxpart back with its associated emlx file?

Thanks
JC

Hi Lance, kind regards from Germany. That is a ver...

2009-11-16T12:01:55.511-08:00

Hi Lance,
kind regards from Germany.
That is a very fine script and also usefull for my work. At know I have a similar problem on an linux image. There I found the mail-client "kmail" and saw, that all mails were stored the mail direkt on file system. After file signatur-analysis the mails get the "alias-pointer" .eml and can be looked at the "doc" tab. I do not test the script for this case, but I believe, that there is no big difference ... . Is there a posibility to get an updated script?

Arndt

Awesome! Thanks for creating and sharing. :) Mari...

2009-11-07T08:17:09.497-08:00

Awesome! Thanks for creating and sharing. :)

Maritza.

Lance, this is a very helpful enscript. However I ...

2009-10-17T22:43:00.573-07:00

Lance, this is a very helpful enscript. However I am having problem exporting emails after I view structure and parse emails. It is not able to export the messages along with the body and attachments. When I export message it just shows header and is missing body sometimes. Thank you.
-Tan

Thanks for the reply lance. Unfortunately, I canno...

2009-10-06T07:50:37.749-07:00

Thanks for the reply lance. Unfortunately, I cannot supply any examples because it's all client data. Nor do I have a mac to create examples with. Hopefully this might help. The emlx filename would take the following convention "filename.partial.emlx". This indicates that it is a multipart emlx. The other multipart files are base64 encoded email attachments. These attachments have the following naming convention "samefilename.[sequenece number starting from 2].emlxpart. They just need to be pasted into the correct area within the emlx file under the NEXTPART header. Not sure how to handle multiple attachements though. Thanks in advance for any assistance.

Jase

Jase, Can you email me an example.

2009-10-06T04:17:56.900-07:00

Jase,

Can you email me an example.

Hey Lance, thanks for that fantastic enscript. I&#...

2009-10-06T03:51:47.491-07:00

Hey Lance, thanks for that fantastic enscript. I'm having an issue with those multipart EMLX files. It seems all that needs to be done is to paste the EMLXPART data into the relevant NEXTPART field in the relevant EMLX file. The problem is that there are around 15000 EMLXPART files to convert. I'm really stumped for resources. I would be grateful is you could you help with an amended enscript?

Thanks in advance,

Jase

Hey, this is a great EnScript.... thanks for creat...

2009-08-31T12:04:37.037-07:00

Hey, this is a great EnScript.... thanks for creating it. It makes parsing Apple Mail much much easier.