Download & Installs the MBOX Forensic Tool. When You run the software, it opens ups with two option
Click on the Scan File Option located at navigation bar to scan and loads Thunderbird file. Select the Mode to Browse the MBOX file from local Storage
After the completion of scanning process, MBOX forensics tool loads the file in recursive manner in the left panel of the software. Click on the email to analyze it in different preview modes like Hex View, Properties View, Mime View, HTML View and much more view are there.
If you want to search for specific emails then click on Search Option then a wide search menu with multiple search option opens. There are many logical operators are available to refine or narrowing your search result such as AND, OR, NOT. You can also add criteria to your search like Subject, To, From, Priority etc. Click on search button to proceed.
When the search process completes then the email with given keywords get listed. There is option available to save the search result for further reference.
When you are done with analysing and searching of MBOX file then MBOX Forensic Tool provides the functionality to export MBOX file in pdf file format.
Thunderbird is an open source email client and available for free download. It provides the services like news, RSS and chat also. This is the supreme feature of Thunderbird email client is that you can single account and multiple account as well. Apart from this, Thunderbird provides the features like message management, junk filtering, tabbed interface, message archiving, global search. Thunderbird stores the email data in MBOX file format. All the message are stored as single , long text file in string of concatenated email messages. The messages in the Mbox is immediately prefaced by a separation line while other messages will begin with two end of line sequences. It stores the copy of message on the local disk. It usually stores without extension and created by default.
Mozilla Thunderbird is the most effective open source email client having all the necessary feature which are mandatory for an email client. Being free software, it have large user spread globally. Anyone can download it and use it to execute crime easily without being noted. Therefore the need of forensic investigation of Thunderbird is essential to caught the suspect. Apart from mbox file format thunderbird creates other file formats as well such as Maildir. To store the contact it use the MAB, MSF and DAT file. So a planned investigation is needed to safely carved out evidences from thunderbird. It requires the deep level of study of thunderbird email data
The thunderbird email forensics gives an option to automatically locate the MBOX files in the user machine. In case the user does not know the drive in which the details stored, the software will search it from all the drives. In order to perform deep analysis of the evidences, Thunderbird emails can be viewed in multiple views present in the software. The different views offered are HTML, Hexadecimal, Attachments, Message Header view, etc. The advance search option in the MBOX file forensics tool enables the investigator to search for a particular email from all the mails of MBOX file. Just entering a particular keyword in the search box will generate all the emails with that email. With the help of Thunderbird Forensics Tool, you can recover the deleted evidences from the MBOX file. Data from both corrupted and damaged MBOX file can be extracted with ease and no data loss.
Thunderbird Forensics is a great investigation tool and it comes with so many features, that the complete investigation is done without any hassles. It is definitely a tool worth investing in.
Candice Nelson, USA
With Thunderbird email forensics, my team was able to carve out evidences even from the mails that were deleted by the culprit. We are really glad that we opted for this tool for our case.
Roman Gomez, Sweden