How to extract the emails from the Windows 10 "Mail" app

[morpheus.bn]

Hi,
I'm a new OS Forensics user. I am testing the functionality of the software but I cannot extract the emails from the Windows 10 "Mail" app.
Does anyone know how to do it?

Thank you

[David (PassMark)]

I think you can open up the Window 10 Mail data files (.dat) in the Unistore folder.

I just need to check the details.

If you had an example file, that might also help.

[Simon (PassMark)]

Logs for the Mail app are written to the directory: \Users\<username>\AppData\Local\Comms\Unistore\dat a

There are a bunch of numbered folders, each storing different things for the Mail app:
0; Windows phone data
2; contact lists within the account
3; the contents/body of the email
5; calendar invitations
7; email attachments
33; contents of invitations


Also, in \Users\<username>\AppData\Local\Comms\UnistoreDB, there is a database file called store.vol, which stores email content. You can view this file using the ESEDB viewer, the tables of interest for us within this database include Message, Contact, Appointment, Attachment, and Recipient:


More info here: https://darkdefender.medium.com/wind...s-39025f5418d2

[morpheus.bn]

The folder contains only the subfolder "5" however by opening the Mail app from the virtual machine the e-mails are there.
There must be another repository somewhere ...

[David (PassMark)]

Were you able to find the store.vol database file?

[morpheus.bn]

I think you can open up the Window 10 Mail data files (.dat) in the Unistore folder.

I just need to check the details.

If you had an example file, that might also help.

There is no dat file. If I index emails, the emails from the Mail app aren't extracted

[morpheus.bn]

Were you able to find the store.vol database file?

Yes, the file is exactly where it needs to be. I open it with the ESEDB viewer but the message table is empty while if I open the virtual machine the messages are there

[David (PassMark)]

OK, we'll setup a test system and poke around a bit. Maybe Microsoft have changed the folder location and database structure (as if it wasn't already a big enough mess).

[Simon (PassMark)]

There is another file we found called: HxStore.hxd
Located: C:\Users\<user>\AppData\Local\Packages\microsoft.w indowscommunicationsapps_8wekyb3d8bbwe\LocalState

The file contains emails saved by the Mail app, though it looks a bit corrupted/encoded/compressed when we try to read with File Viewer.

More info: https://boncaldoforensics.wordpress....mail-research/

So there must have been a fairly recent change to start using this file. Considering this a Microsoft App it is super badly documented. We don't know what the format is an it seems no one does.

Really sucks for users if they want to backup or restore their EMail and are using POP3.

[morpheus.bn]

No progress at the moment. I can't extract the emails! I would like to find this feature in the future...

[David (PassMark)]

Was the EMail account setup with POP or IMAP?
If it was IMAP then all the EMails should be sitting on a server somewhere and you won't need to look at cached local fragments.

[TayZz]

I have been given this task recently to extract the mail preferably into a pst to import into outlook as the outlook has not synced some older emails that are needed, we have the PC were the email files are stored but have been left falling into a rabbit hole of the unknown with .hxd files and nowhere to find EML files. just wondering if there is any updates into the research of this thread

[David (PassMark)]

No one has asked about this since 2021. We've done no further research into it.

Was the EMail account setup with POP or IMAP?
Most are IMAP nowadays. If it was IMAP then all the EMails should be sitting on a server somewhere and you won't need to look at local HXD files.

[securized]

I know this is quite an old post, but I went ahead and completed a full reverse engineering of the format.

This format is used on both Window Mail, and New outlook on Mac. Probably new outlook on windows as well.

Wrote a blog post here: https://securized.dev/hxstore-reverse-engineering/
And GitHub repo with the tool, and format spec: https://github.com/securized/hxstore...se-engineering

Any questions reply and i'll do my best to reply

[David (PassMark)]

Thanks for the updated details. Someone might find it useful, even if Windows Mail is now dead and buried.

Probably new outlook on windows as well

New Outook is basically a web page. I don't think much is stored locally anymore, at least not be default?