Autopsy can't parse all mails in a big size mbox file

Autopsy Development
1

Dear Autopsy teams and users,

Please upgrade the autopsy to make it can parse all mails in a big size mbox file. I have 3GB mbox file and want to analyze it by parsing it to autopsy. Unfortunately, autopsy can’t parse all the mails. If you have the same problem with me, please share it here. Thanks

2

Which version of Autopsy are you using. This issues was addressed in the following PR and it should have been fixed 6381 mbox files greater then 2gb will not be processed in email parser by markmckinnon · Pull Request #5985 · sleuthkit/autopsy · GitHub.

What do you mean that it does not parse all the mails?

3

I used the latest one, 4.19.1. I added a .mbox file with 3.9 GB (more than 8,000 mails) in Data Source then I ran email parser module, but after it finished parshing, it only showed less than 2,000-3000 mails. FYI, I used a laptop with 32GB RAM to run the autopsy.

And one last thing, I suggest that the table in data artifact-email messages has one column that indicates whether a message has an attachment file or not.

Thanks for your response

4

Same challenge here. I have a smaller mbox (from Google). Other tools find hundreds of emails within while Autopsy 4.19.1 finds about 20. Any help would be appreciated.

5

Would you be able to share the mbox file with the Autopsy development team?