Searching and filtering in Mbox Viewer

What is searching and filtering in Mbox Viewer?

Mbox Viewer by Cloud Captains is a Chrome extension for opening and searching email archives. Whether you have an old Thunderbird archive, a Google Takeout export or a handful of loose .eml files, you drag them into the window and browse them as if it were Gmail: the message list on the left, the open message on the right.

As soon as an archive grows large, scrolling no longer gets you to one specific message. That is what the search bar is for. You do not just type loose words, you use search operators: short commands that tell the app exactly where to look. Think of from: to filter by sender or has:attachment to show only messages that carry a file. On top of that you organise your archive with labels, stars and notes, so you can find important messages again later.

Why search operators are useful

An ordinary search looks everywhere at once: in the sender, the subject and the body. That usually returns far too many results. Operators let you sharpen your query. Instead of hundreds of messages that happen to contain the word invoice, you ask for, say, only messages from a particular sender, with an attachment, from a specific period. That takes you from thousands of messages down to the few you actually want.

You combine operators simply by typing them one after another with a space in between. Everything you type then has to match (a logical AND). So from:jane has:attachment shows only messages from Jane that also include an attachment.

All the search operators at a glance

Below are all the operators with an example. You type them straight into the search bar.

Using dates and time spans well

There are two ways to filter by time. before: and after: work with a fixed date in year-month-day format, so after:2024-03-15. Handy when you have a concrete period in mind.

older_than: and newer_than: work with a span counted from today. You give a number and a letter: d for days, and likewise for weeks, months and years. newer_than:7d shows everything from the past seven days. older_than:30d shows everything older than thirty days. This is ideal when you do not know the exact date but you do know roughly how long ago something happened.

Filtering by size

With larger: and smaller: you filter by the size of a message. Use M for megabytes and K for kilobytes. larger:5M surfaces the heaviest messages, often those with big attachments. smaller:1M shows the lighter ones instead. Combine this with has:attachment to quickly track down the largest attachments in your archive.

Finding suspicious messages

is:suspicious shows every message that Mbox Viewer has flagged as potentially dangerous. On the Forensic tab the extension assigns each message a suspicion score based on signals such as failed authentication, a mismatched Reply-To address, punycode domains or a display name that does not match the real email address. This operator brings all the questionable cases to the surface at once, for example when you are investigating a phishing campaign inside an archive.

Regex mode

Alongside the regular operators, Mbox Viewer has a regex mode. Regex (regular expressions) is a way to describe patterns rather than fixed words. With it you can search for, say, every message with an order number that starts with INV followed by digits, or several spellings of a name at once.

You switch regex mode on in the search bar. From then on you no longer type plain text but a pattern. This is an advanced feature: if you have never worked with regex, the ordinary operators will usually get you a long way already.

Saved searches

Do you run the same query over and over? Save it. A saved search remembers your complete string of operators so you can run it again with a single click. Handy for recurring tasks, such as reviewing all suspicious messages every week or jumping straight to a particular supplier's invoices.

Organising with labels, stars and notes

Search finds messages again, organising keeps them tidy. Mbox Viewer gives you three ways to mark messages, and they all work together with the search operators.

Labels (tags) are free-form labels you attach to a message, for example legal, tax-office or project-x. A message can carry several labels. Later you filter on them with tag:legal.

Stars (favourites) mark a message as important. It is a simple on-off marker. You bring back all your starred messages with is:starred.

Notes (Captain notes) are free text you leave on a single message, for instance a reminder of why this message matters to a case. The note belongs to that one message.

Filtering by attachment, source file and date range

Next to the search bar, Mbox Viewer has standalone filters that trim the list quickly without typing operators. You can filter by the presence of an attachment, by the source file (handy when you have several archives open at once and only want messages from one particular .mbox file) and by a date range. These filters work alongside your query: you can type an operator first and then narrow further with a filter.

Practical examples

A few common combinations to get you going:

• Every email with an attachment from a specific sender: from:accountant has:attachment
• Large messages from the past year: larger:5M newer_than:365d
• Invoices, but no reminders: subject:invoice NOT reminder
• An exact phrase in a subject: subject:"annual statement 2024"
• An attachment with a particular name: filename:contract*
• All suspicious messages from a certain domain: is:suspicious from:unknown.tk