Recognition of e-mail types

Autopsy Feature Requests
21

Hi all,

consider this simple test case:

Data Source (logical files) with only 1 EML mail inside.

EML mail with :

  1. only one keyword (“Hello world”) inside the plaintext.
  2. pdf file attached (with no relevant keyword)

After running (simultaneously) Keyword Search + EMAIL Parser ingestion process , keyword hits “Hello World” related seems always to be duplicated.

Where am i wrong ?

Looking foward to receving your feedback.

Thanks in advance

Luca

22

What version of Autopsy supports the recognition of EMLs? I am currently on 4.13…

Thanks,

Bob

23

4.13 supports it as well as a third party plugin for 4.13 and some prior versions.

24

I imported about 10k+ EMLs and they show up under “Account”, but not under “Emails”. In addition the emails are not recognized as such in that the “message” tab is stil greyed out…

Just as a follow-up, I had exported these from a PST (which was not recognized by Autopsy I think because it is an old PST) using a conversion tool. I wonder if the correct signature was applied as they were exported. What is the file signature for an EML?