← All artifacts

Apple Mail

Apple Mail artifacts including the Envelope Index database, EMLX message files, account configuration, and Apple Intelligence metadata.

Status
available
CLI plugin
mail.apple
Categories
communication, user

Overview

Apple Mail stores email metadata in a central Envelope Index database and individual messages as EMLX files on disk. The collector captures message metadata, parses EMLX files for full message content and headers, and extracts account configuration. On macOS 15+, Apple Intelligence categorisation data from the message_global_data table is also collected.

Analysis Tips

  • Directory versioning: Mail data directory ranges from V2 (macOS 10.7) to V10 (macOS 10.15+), detected via PersistenceInfo.plist
  • EMLX format: First line is byte count, followed by RFC 2822 message body, then trailing XML plist with flags and conversation metadata
  • Account enumeration: Cross-reference Accounts4.sqlite with mailbox structure to map messages to accounts
  • Apple Intelligence: On macOS 15+, message_global_data holds the category (primary, transactions, updates, promotions), subcategory, and high-impact and urgent flags assigned to each message

Related Artifacts

References

Data sources

Envelope IndexSQLite

~/Library/Mail/V{N}/MailData/

Message metadata, sender, recipients, subjects, flags, timestamps

{N}.emlxText + Plist

~/Library/Mail/V{N}/{Account}/{Mailbox}.mbox/

Individual email messages (byte-count + RFC 2822 + trailing XML plist)

Accounts4.sqliteSQLite (Core Data)

~/Library/Accounts/

IMAP and Exchange account configuration

PersistenceInfo.plistPlist

~/Library/Mail/

Mail directory version detection (V2-V10)