Mail (Apple Mail)

Overview

Apple Mail (Mail.app) is the default email client on macOS, storing email messages, metadata, and account configuration locally on disk. Mail uses a hybrid storage approach: structured metadata is stored in the Envelope Index SQLite database, while individual email messages are stored as EMLX files on the filesystem. Account configuration is managed through a shared system database at ~/Library/Accounts/Accounts4.sqlite.

Mail organizes its data in a versioned directory structure (V2 through V10) that changes with major macOS releases. Since macOS 10.15 Catalina, the current version is V10.

Starting with macOS 15 Sequoia, Apple Intelligence adds email categorization and summarization data to the Envelope Index database.

File Locations

Mail Data Directory

The Mail data directory version is determined by the macOS version:

The active version can be confirmed by reading ~/Library/Mail/PersistenceInfo.plist.

Primary Artifacts

Additional Artifacts

Directory Structure

~/Library/Mail/V10/
  MailData/
    Envelope Index
    Envelope Index-wal
    Envelope Index-shm
    SyncedRules.plist
    SyncedSmartMailboxes.plist
  {Account-UUID-1}/
    INBOX.mbox/
      {UUID}/Data/Messages/
        1.emlx
        2.emlx
    Sent Messages.mbox/
      ...
  {Account-UUID-2}/
    ...

Database Schema / File Format

Mail uses two primary data formats:

1. Envelope Index -- SQLite database containing message metadata, addresses, subjects, mailbox references, and attachment info. See Envelope Index.
2. EMLX files -- Individual email messages stored as byte-count-prefixed RFC 2822 content with a trailing Apple plist. See EMLX Format.

Key Fields for Analysis

• Sender and recipients: The Envelope Index addresses and recipients tables provide structured sender/recipient data without needing to parse EMLX files.
• Message timestamps: date_sent and date_received in Unix epoch seconds.
• Read/flagged/deleted status: Both individual columns (read, flagged, deleted) and a comprehensive flags bitmask.
• Conversation threads: The conversation_id column links related messages.
• AI categorization (macOS 15+): The message_global_data table classifies messages as Primary, Transactions, Updates, or Promotions.
• Mailbox URL: Identifies the account and folder (e.g., imap://user@imap.example.com/INBOX).

Timestamps

The Envelope Index uses standard Unix timestamps (seconds since 1970-01-01 00:00:00 UTC) for date_sent, date_received, and date_last_viewed.

SELECT datetime(date_received, 'unixepoch') AS received_utc FROM messages;

EMLX trailing plist metadata also uses Unix timestamps for date-received and date-last-viewed.

Analysis Notes

• Version detection: Always check ~/Library/Mail/PersistenceInfo.plist first. If the plist is missing, attempt paths from V10 down to V2.
• Multiple accounts: Each email account has its own UUID subdirectory under the Mail version directory. EMLX files are organized by account and mailbox.
• Envelope Index as primary source: The Envelope Index provides faster access to message metadata than parsing individual EMLX files. For most forensic purposes, the Envelope Index alone is sufficient.
• EMLX for content: Full message body, headers, and inline content require parsing the EMLX files. This is necessary when message content analysis is required.
• Attachment tracking: The OpenedAttachmentsV2.plist file logs which attachments the user has opened, providing evidence of user interaction with email attachments.
• Mail rules: The SyncedRules.plist file may reveal automated email handling that could be relevant in data exfiltration or evidence destruction scenarios.

Version Differences

Tool Support

References

• EMLX File Format Analysis
• Apple Mail Email Format - Library of Congress
• Jamie Zawinski's EMLX Flags Documentation
• Apple Mail Forensics - MailXaminer