EML file
- EML file
A single email message saved to disk in the standard internet message format — headers, body and attachments together in one plain-text file, exactly as the message travelled between mail servers.
What is inside one
Open an .eml in a text editor and you see the message the way mail systems
see it. A block of headers comes first: From, To, Subject, Date, and
below them the transport headers a reader never normally sees — the Received
chain recording each server the message passed through, the Message-ID that
uniquely identifies it, and any authentication results.
After the headers comes the body, usually in two versions: plain text and HTML. Attachments follow, base64-encoded into the same file. The whole structure is MIME, the same standard that has defined internet mail for three decades.
Why it matters for evidence
Because it is the message rather than a picture of the message. The .eml is
the native form of an email, which is why it is
the thing to collect and retain even when what you produce is a PDF.
Two properties do the work. The transport headers are present, so questions
about where a message actually came from have somewhere to be answered. And
the attachments are carried in their original bytes, so an attachment extracted
from an .eml hashes identically to the one that was sent.
Where they come from
Most mail systems will produce one. Gmail downloads individual messages as
.eml. Outlook on the web does the same, though the classic Outlook desktop
client saves .msg instead. Apple Mail exports raw
message source. Thunderbird stores mail in .mbox archives that split into
.eml files.
The practical problem
Almost nothing outside a mail client displays one usefully. Double-clicked on a
machine with Outlook installed, an .eml opens as a live, replyable message —
which is a hazard in a review set. Opened anywhere else, it is a wall of
headers and base64. That gap between “correct format to keep” and “unusable as
an exhibit” is the reason
converting to PDF is a step at all.