Apple Mail Message (EMLX)
| Format | Apple Mail Message (EMLX) |
|---|---|
| Short name | EMLX |
| Category | document |
| Platforms | macOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Apple Mail's per-message storage on macOS, typically below ~/Library/Mail/V<n>/ in the Messages subfolders of .mbox mailbox directories, with numeric file names. A file starts with a line holding a decimal byte count, followed by the message in RFC 5322 / MIME form and an XML property list with Apple Mail metadata such as flags (read, replied/forwarded, flagged, junk) and the receipt date. '.partial.emlx' files hold messages whose attachments are stored separately in an Attachments folder. No signature; recognised by the byte count line and the trailing property list.
Signatures
None recorded
Known extensions
.emlx
References
- Apple Mail Email Format (EMLX) (Library of Congress) https://www.loc.gov/preservation/digital/formats/fdd/fdd000615.shtml
Cite this entry
Crush Format Reference, “Apple Mail Message (EMLX)”. https://kalink0.github.io/crush-forensics/formats/emlx/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction