Jump to content

Mac Email Metadata Fields


Recommended Posts

I have had occasion to deal with Mac-based email recently in two different (non-forensic) matters.  In one situation, I exported from the Mail App. to multiple MBox archives.  In addition, I exported the raw Mail data from the hidden folder structure in the Mac Library.  In the second situation, I had the distinct pleasure of exporting mail from the defunct Entourage app, last released in Office for Mac 2008. 


With that background, two questions - does anyone know of some online documentation regarding the specific metadata fields present in Mac email (such as X-Apple-Auto-Saved: 1 or X-Apple-Mail-Remote-Attachments: YES)?  I was hoping to find something like the Microsoft developer information for Outlook, which gives you this level of detail if you know where to look.


Also, with regard to the X-Apple-Auto-Saved: 1 - I gather that this refers to the AutoSave feature that is enabled by default in some of the more recent versions of OS X.  However, what troubles me is that these items all appear to have a Sent date, even they could possible be just a draft, which I say based on their location in my collection vs. not being present in the Sent items.  Any insight on this subject could be greatly appreciated!





Link to comment
Share on other sites

  • 2 weeks later...
  • Create New...