This script is designed to iterate through the contents of a single, selected (blue-checked) Windows Live Mail storage folder (referred to as the target folder in the text below) and create a separate MBOX file for each sub-folder and the EML mail-messages contained therein.

The resultant MBOX file(s) are written into a single logical evidence file with their relative paths preserved. The name of each MBOX file will reflect the name of the folder whose e-mail it contains. The resultant LEF can be added to the case and processed in the usual way so that the encapsulated e-mail and any attachments can be accessed via the Records tab.

The examiner can opt to process all or selected EML files in the target folder. The target folder should be blue-checked in the right-hand (table) pane so as to avoid blue-checking any sub-folders by mistake.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training