Converting an MBOX archive to PDF exhibits

One file, an entire mailbox

The format is about as simple as file formats get: messages written one after another in plain text, each one preceded by a line beginning From. That simplicity is why it has outlived nearly everything it competed with, and why Google, Thunderbird and Apple Mail all still use it.

It also means an .mbox is an undifferentiated blob. There is no index, no folder structure inside it, and no way to look at one without a tool that understands the format. A Takeout export labelled All mail genuinely contains all mail, including everything irrelevant, privileged and personal.

The scope decision comes first

The instinct is to split the archive and then work out what to produce. Do it the other way around.

An .mbox from a working mailbox holds years of correspondence. Splitting it produces tens of thousands of .eml files, at which point you are handling — and have technically collected — a great deal of material that is not in scope, including privileged communications and the custodian’s personal mail. Filtering inside a mail client before exporting is both less work and a cleaner position.

The filters that usually do the work:

• Custodian and date range, which are typically defined by the request itself.
• Search terms agreed at meet-and-confer, or your own if none were.
• Thread completeness — pull whole threads rather than individual hits, so that context is not something you get accused of stripping.

Splitting without shipping the mailbox somewhere

Thunderbird is the pragmatic answer for most small firms: import the .mbox, which it reads natively, use the search and filter tools to isolate what is in scope, then export those messages as individual .eml files. It runs locally, it is free, and nothing leaves the machine.

Local command-line splitters exist and are faster for large archives if someone in the office is comfortable with a terminal.

What to avoid is the category of web service that accepts an entire .mbox upload. The confidentiality exposure is not the messages in dispute; it is the several thousand that were never in scope and are now on somebody else’s server.

Then it is an ordinary batch

Once the archive is a folder of .eml files, the rest is the standard path: batches of up to 100, PDF or TIFF, matter prefix, date sort, combine if the whole set is going in as one exhibit. See converting EML to PDF for what the output contains.

How to do it in EML Exhibit

1. Work out how big the archive is

   Check the file size and, if you can, the message count. A Google Takeout export of a working mailbox routinely holds tens of thousands of messages. That number determines whether this is a self-service job or one for a vendor.

2. Cull before you split

   Filter to the custodian, date range and search terms that are actually in scope. Splitting first and filtering later means handling thousands of messages you were never going to produce.

3. Split the archive into individual .eml files

   Import the .mbox into a desktop mail client such as Thunderbird and export the messages you need, or use a local mbox-splitting utility. Prefer tools that run on your own machine over web services, since the archive holds an entire mailbox.

4. Convert in batches of 100

   Drop up to 100 .eml files in at a time, choose PDF, set a matter prefix and sort by email date. Run as many batches as the set needs; the prefix keeps them collated.

5. Keep the original archive

   Retain the untouched .mbox. It is the collected native, and the fact that a production was derived from it is part of the record of how the evidence was handled.