Investigating Eudora Mailstorage
Posted by Jack H. Ward, Last modified by Jack H. Ward on 06 February 2018 04:16 AM

Eudora mailstorage is stored in *.mbx files or the Eudora folder.

Mailstorage default location:

Windows 7, 8, 8.1, 10


The Application Data folder (AppData in Windows 7, 8, 8.1, and 10) is hidden by default.

If you want to add the whole mailstorage, navigate to the Eudora folder and add it to Electronic Evidence Examiner.

If you want to add a specific folder from the Eudora database (e.g., Inbox or Outbox folder), in the Eudora folder, navigate to the *.mbx file and add it to Electronic Evidence Examiner (e.g., add the In.mbx file to add the Inbox folder, add the Out.mbx file to add the Outbox folder, etc).

To investigate Eudora mailstorage, do the following:

1. Have the Add New Evidence window open. 
2. In the Category list, select E-mail Database. In the Source Type list, select Eudora database. Click OK.

3. In the Select source for mounting window, select the Folder option to open the folder containing the mailstorage. Select the File option to open a *.mbx file.
4. If you select the Folder option, in the Browse For Folder window, navigate to the folder containing the Eudora mailstorage and click Open. If you select the File option, in the standard Open window, navigate to the *.mbx file and click Open.
5. Enter the Evidence name (by default, the name of the file/folder to be added) and click OK.
6. The Eudora mailstorage is added to the case.
7. The mailstorage structure is displayed in the Case Content pane (to the left), messages stored in the mailbox are displayed in the Data View pane (to the right).
8. The deleted messages are displayed in the Data View pane in the folders they were deleted from. The deleted messages are marked with a red X.
9. Select the message in the Data View pane. Its contents are displayed in the E-mail Data pane (at the bottom).
10. You can view the message contents in different formats and/or view the attachments.

     Eudora.png (44.25 KB)
    (0 vote(s))
    Not helpful

    Comments (0)