E-mail Message (EML / RFC 5322)
| Format | E-mail Message (EML / RFC 5322) |
|---|---|
| Short name | EML |
| Category | document |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
A single e-mail message as text: header fields (From, To, Date, Subject, Message-ID) and the Received chain, which records each server that handled the message with time and addresses (newest on top; only entries added by trusted servers are reliable, lower entries can be forged), followed by the MIME body and attachments. Authentication results (SPF, DKIM, DMARC) in the headers help judge whether a message is genuine. No signature; recognised by its header lines.
Signatures
None recorded
Known extensions
.eml
References
- Internet Message Format (RFC 5322) https://www.rfc-editor.org/rfc/rfc5322.html
Cite this entry
Crush Format Reference, “E-mail Message (EML / RFC 5322)”. https://kalink0.github.io/crush-forensics/formats/eml/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction