I imported and parsed a Thunderbird folder with emails. Seems to have parsed and I have results under E-mail Messages in the tree view. In the listing view I see the individual emails. When I click on one I can see the email and content under the results tab in the HTML view. Looks like a email and can go get images as well. In the documentation I see there is a Message tab that I do not see. When i bookmark the file in the listing view and then try a test report I only get a table with the individual files noted. No hyperlinks no email view. Am I missing something. Is this how things work in Autopsy? Do I need to setup an external viewer for this?
In Autopsy, there are two types of tags: File and Result. If you tag a file when viewing a result, you are bookmarking the parent file, in this case, the MBOX file itself.
If you want to bookmark an individual email that was extracted from the MBOX, you need to use a Result tag.
http://sleuthkit.org/autopsy/docs/user-docs/4.17.0/tagging_page.html
As for the rest of your question, I’m not clear on what you are saying. I can only comment that sometimes the documentation lags behind changes in Autopsy, so the screenshot in the help might not reflect changes to the interface. I’d recommend that you test Autopsy’s results by extracting the MBOX file and 1) opening in an application designed to handle MBOX files (e.g., Thunderbird) and/or 2) parse the file manually to ensure all of the elements of the email are properly extracted.
Bear in mind all emails (and html) are not created equally: images can be embedded (base64) or hyperlinked. Some email is plain text, some is html which viewers can render with rich text. Therefore, what you experience with your own analysis might differ from an example.
For the message tab I had mentioned. In the picture from the user documentation for emails there is supposed to be a Message tab. I have circled it in red from the screen capture from the documentation.
I will have to continue my answer in another reply
Below is a screen capture of a example email I was viewing. It is an email and it is noted as such in the Tree Viewer. The message tab is not present. From what I understand the message tab should appear when a email is being looked at. This is why I was wondering if I was missing something in my setup.
So when I bookmark this I only get a single row of text with the file contents stretched way out to the right in the report which is not really usable.