Hope this post finds you well.
I’m having a few issues when running keyword searches over an MBOX email account in Autopsy.
The email parser works just fine and I have a bunch of email extracted from the MBOX files. The problem I’m having is that when I run a keyword search all of the hits returned are from the raw MBOX files rather that the separate emails. Is this normal?
What I’d like to do is return the emails that have keyword hits, run a further date filter and export the individual emails. Is this possible?
Thank you for any help you can give.