JNevins Posted July 13, 2016 Report Share Posted July 13, 2016 Hello all: I am re-visiting a sore spot related to the export of mail items as handled by Intella when original format is selected. The items are exported as .eml file types, which as I understand was a common format when the Outlook Express application was readily used and available. However, all attempts to find a simple, preferably free tool, to provide to clients and/or use myself to view the output .eml files has run into one snag or another. I have tried the following with various problems (inability to load large file groups, won't open attachments, annoying adware, random crashes, etc.) Kernel EML Viewer, Free EML File Viewer, EML Reader. Please share with me any solutions you have found to this issue be it free or pay. Thank you! Link to comment Share on other sites More sharing options...
AdamS Posted July 14, 2016 Report Share Posted July 14, 2016 You can make registry changes to fix Outlook 2003-2007 to view .eml files (link below), however this might not be ideal when it comes to helping clients view files you provide them unless they are quite tech savvy. https://www.msoutlook.info/question/354 Outlook 2010 has native support for .eml so there should be no issues there if your clients use that version. Also Microsoft provided a hotfix for this issue for Outlook 2007 (link below) which is probably a better solution as it's official, however the hotfix is essentially an automated registry fix. https://support.microsoft.com/en-us/kb/956693 Otherwise Thunderbird Mail client can view .eml with no problems. Below is another solution that works http://www.blog.creativform.com/import-eml-files-to-microsoft-outlook/ And finally instead of exporting the items as individual .eml files you can export them as a PST, import that PST into Outlook on your analysis machine, then use Outlook to export/save as .msg files to give to your client. A little bit round-a-bout but it works if you feel you must give your clients .msg for ease of use. I'm sure there are plenty of other solutions but those are the methods I tend to use. Link to comment Share on other sites More sharing options...
ŁukaszBachman Posted July 14, 2016 Report Share Posted July 14, 2016 That's very useful Adam, thank you! Link to comment Share on other sites More sharing options...
JNevins Posted July 18, 2016 Author Report Share Posted July 18, 2016 Adam, Thanks for the multiple options for possible solutions. I am sure one will work. I am curious to get your take (and Mr. Bachman's as well) on the idea of the use of .eml as "original format" for output from Intella. Is it generally understood that original format of email contained within an OST or PST file is .eml? In my case I did provide the client with a single PST file containing all results, but they stipulated they must have native/original format as well... this may fall into the "personal interpretation" side of things. In the case when your client requests native/original format, what do you provide? Link to comment Share on other sites More sharing options...
AdamS Posted July 19, 2016 Report Share Posted July 19, 2016 I think from memory I have asked something very similar previously but I can't find the post at the moment. It was along the lines of the way Outlook deals with messages, they aren't actually 'saved' as individual .msg files within the PST archive, the PST archive is a live database of sorts. When you choose to export/save an individual email with Outlook it uses the .msg format after it extracts the email from the database. So you could argue that Outlook emails don't have a 'native' format, however that's a technical argument at best. If the client is asking for native format then PST is native format as that is how they are stored when in use, however for individual items I tend to check what email client they will be using to view the emails, then provide them with .eml or .msg as required. I know Intella developers have had this on the 'to do' list for some time and I suspect it's slipped under the radar with all the developments that 1.9.1 brought to the table, but I would add my voice to JNForensic to have this brought up the list a little if possible so we can have the option of using .msg or .eml when exporting individual emails. Link to comment Share on other sites More sharing options...
admin Posted July 19, 2016 Report Share Posted July 19, 2016 Hi - This is an interesting question. Is it generally understood that original format of email contained within an OST or PST file is .eml? A PST/OST, NSF and most other mail containers do not contain .eml's, .msg or any other form of individual file or "envelope". They are databases - the structure has more in common with a spreadsheet than .eml's/.msg files which some consider as native. When you export from the mail database you choose which fields and data to use. Intella then takes those fields and formats them according to the MIME type https://en.wikipedia.org/wiki/MIME hence you end up with .eml format file. Other programs offer the ability to export NSF, .MSG or Mbox. So when you are asked for natives, explain that you can offer PST or .eml conversion from the original data to near native as is possible as there is no 100% accurate way to export a message from PST to a loose file. This becomes even more confusing when you have NSF and/or Mbox files you are asked to export into a single PST but not change any data. How can you say that the created date of a mail from a NSF was not changed when you you completely changed its format and database (NSF to PST) storage mechanism to a PST. . Link to comment Share on other sites More sharing options...
JNevins Posted July 19, 2016 Author Report Share Posted July 19, 2016 Thanks for the input from you both. I have known for years of the database structure of the PST/OST files and have always chuckled a bit at the concept of exporting to native/original given the originating file type. I too would like to see the flexibility to export to .eml or .msg in future releases. In the long run I guess it is just what the client asks for (or what we know they need but they haven't asked for in so many words) that counts. 1 Link to comment Share on other sites More sharing options...
Recommended Posts