What does exporting mean in Mbox Viewer?
Mbox Viewer by Cloud Captains is a Chrome extension (version 1.6.5) that lets you open and read email files the way you are used to in Gmail or Thunderbird: the list on the left, the opened message on the right. Beyond reading and searching, you can also take emails out of the extension in a format you can use elsewhere: a tidy PDF for a case file, an EML or MBOX file to open in another email program, or an HTML page to view in a browser.
On top of that there is a special feature for anyone who uses emails as evidence: the forensic case file. This is a single package that neatly bundles the original emails, forensic reports, checksums (hashes) and an overview list (manifest), optionally protected with a password.
The most important thing to know: everything happens locally on your own computer. Mbox Viewer works 100% offline. No files are uploaded, there is no server running and nothing is tracked. Your emails stay yours and never leave your device when you export.
Why is this useful?
Exporting comes in handy in many different situations. A few examples:
- You want to keep an important email as a PDF for your records or a legal file.
- You want to move emails from an old mailbox (for example a Google Takeout export) into another program using EML or MBOX.
- You want a list of senders, subjects and dates for an investigation, which you get with a CSV file.
- You are examining possibly suspicious or fraudulent emails and want to capture the evidence in a way that can be checked later, which is exactly what the forensic case file is for.
Because everything stays local, you can also handle sensitive messages without them ending up online anywhere.
Exporting a single message
To take a single message out, open it in the list and choose the format you want. You have four choices per message:
- PDF: a fixed, tidy rendering that is easy to share, print or archive.
- EML: the standard email format that almost every email program can open.
- HTML: the email as a web page, handy for a quick look in a browser.
- MBOX: the mailbox format, suitable for loading into programs like Thunderbird.
Export a single message
- Open the message you want to export in the list on the left.
- Choose the export option and select the format: PDF, EML, HTML or MBOX.
- For a PDF, set the parts you want to include if needed (see below).
- Confirm and choose where the file is saved on your computer.
The PDF options
A PDF in Mbox Viewer is not just a picture of the message. You decide which parts go into it. You can switch these parts on or off:
- Headers: the header lines of the email, such as sender, recipient, subject and date.
- Text: the ordinary readable content of the message.
- Raw source: the complete unprocessed source code of the email, for when you want to be able to check word for word what was there.
- Attachment list: an overview of the files that were attached to the email.
- Forensic report: the results of the forensic examination, such as authentication outcomes, the transport chain and the suspicion score.
Choose the PDF parts deliberately
For a plain archive, headers plus text is usually enough. If it concerns evidence or an investigation, also turn on the raw source and the forensic report so all verifiable details are inside the file.
Exporting in bulk (several messages at once)
If you have selected several emails, you can export them all at once. You select by ticking messages (shortcut x per message, or Shift+A to select everything). A bulk export gives you these choices:
- EML-ZIP: all selected emails as separate EML files, together in a ZIP folder.
- PDF-ZIP: a PDF of each email, together in a ZIP folder.
- HTML-ZIP: an HTML page of each email, together in a ZIP folder.
- CSV metadata: a table file with the details of the messages (such as sender, recipient, subject and date), handy to open in a spreadsheet.
- Forensic case file: the complete evidence package, explained further below.
Export several messages in bulk
- Tick the messages you want to include, or use Shift+A to select everything.
- Choose the bulk export option.
- Select the format: EML-ZIP, PDF-ZIP, HTML-ZIP or CSV metadata.
- Confirm and save the ZIP or CSV on your computer.
The forensic case file
The forensic case file is meant for situations where emails serve as evidence, for example when you suspect phishing, fraud or a dispute. It is a ZIP package that bundles everything you need to verify the evidence later, all at once:
- The original emails themselves.
- Forensic PDF reports per message, including the authentication outcomes (SPF, DKIM, DMARC), the transport chain and the suspicion score.
- Hashes: checksums (SHA-256, SHA-1 and MD5) per attachment, with which you can show that a file has not been changed.
- A manifest: an overview list of everything in the package.
You can optionally protect the case file with a password. The contents are then encrypted with AES-256, a strong standard that is also used in the security world.
Build a forensic case file
- Tick the messages you want to include in the evidence package.
- Choose the bulk export option and select the forensic case file.
- If you want to protect the package, enter an AES-256 password.
- Confirm and save the ZIP package on your computer.
- Store the password separately in a safe place, because without it you can no longer open the package.
Keep your password safe
An AES-256 encrypted case file cannot be opened without the correct password. There is no recovery or backup key, because everything lives only on your own device. Write the password down in a safe place before you hand the package over.
Why hashes matter
A hash is a kind of digital fingerprint of a file. If anything at all changes in the file, the hash changes too. By comparing the hashes from the manifest, you can later prove that the attachments remained exactly as they were when you exported them.
Watch out for external images in PDF exports
When reading emails, Mbox Viewer blocks external images by default to protect your privacy and to stop tracking pixels. If you do want such an image to appear in a PDF export, you first have to load it per message with the dedicated button. This is the only moment the extension uses external network access, with your permission: to fetch that specific image for your export.
Privacy when exporting
Leave external images blocked if you want to be sure no request goes out at all. If you need the images for the content of your PDF, load them deliberately per message and know that only then is an external image fetched.
Learn more
Mbox Viewer is made by Cloud Captains, with Captain Frank as its mascot. You will find more information and the extension itself on the homepage https://mbox-viewer.online and at the company on https://cloud-captains.com.
Where are my exported files saved?
The files are saved locally on your own computer, in the location you choose when saving. Mbox Viewer works fully offline and sends nothing to a server.
What is the difference between a plain PDF export and the forensic case file?
A PDF export is a readable file of one or more messages that you assemble yourself with parts such as headers, text and optionally a forensic report. The forensic case file is a complete ZIP package with the original emails, forensic PDFs, checksums (hashes) and a manifest, meant to capture evidence in a verifiable way.
Can I export many emails at once?
Yes. Tick several messages (or use Shift+A for everything) and choose a bulk format: EML-ZIP, PDF-ZIP, HTML-ZIP, CSV metadata or the forensic case file.
What happens if I lose the password for my case file?
Then you can no longer open the package. The AES-256 encryption happens locally and there is no backup key or recovery option, so keep the password in a safe place.
Do external images end up in my PDF automatically?
No. External images are blocked by default. They only end up in your PDF if you first load them per message with the dedicated button. At that moment the extension fetches that image, in every other case nothing goes out.
Which format should I pick to move emails to another program?
Use EML for individual messages or MBOX for a mailbox. Both formats are recognised and loaded by most email programs, such as Thunderbird.