Mbox Mailbox
| Format | Mbox Mailbox |
|---|---|
| Short name | mbox |
| Category | document |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
A mailbox stored as one text file of concatenated e-mail messages, each starting with a 'From ' separator line (sender and UTC date). Used by Thunderbird (folder files without extension, e.g. 'Inbox', 'Sent'), Apple Mail exports (.mbox package containing an 'mbox' file), Google Takeout and Unix mail spools. Variants (mboxo, mboxrd, mboxcl, mboxcl2) differ in how body lines starting with 'From ' are escaped ('>From ') or whether Content-Length headers delimit messages; mboxo escaping is irreversible. Messages deleted in the client can remain in the file until it is compacted.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 46 72 6F 6D 20 | From | Separator line 'From ' |
Known extensions
.mbox, .mbx
References
- The application/mbox Media Type (RFC 4155) https://www.rfc-editor.org/rfc/rfc4155.html
- ForensicsWiki — Mbox https://forensics.wiki/mbox/
Cite this entry
Crush Format Reference, “Mbox Mailbox”. https://kalink0.github.io/crush-forensics/formats/mbox/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction