This EnScript is designed to convert Microsoft Outlook *.olk14MsgSource and *.olk15MsgSource message-files to *.EML files that can be opened in a suitable application.

Mozilla Thunderbird works well for this purpose, as does the Apple Mail application. Microsoft Outlook can also be used, but it may not format every message properly.

The script will process all or selected message-files in a single blue-checked folder in the current view. Note that the folder should be blue-checked in the right-hand table pane, *not* the folder pane, which could inadvertently blue-check one or more sub-folders.

Each converted file will be written with a *.EML extension appended to its file-name. The structure of the folder(s) containing converted Outlook messages will be preserved. Folders that don't contain converted Outlook messages won't be created.

In addition to writing each converted message to a separate file, the script will write each message to a single MBOX file in a logical evidence file, which can be brought back into EnCase, processed and the resultant e-mail data examined, searched and bookmarked in the usual way.

The bookmark-folder name specified by the examiner will also be used for the name of the logical evidence file and the name of output sub-folder created by the script. It cannot therefore contain characters such as '<>:"/\|?*', which aren't permissible Windows file/folder-name characters.

Note that each message in the MBOX file will start with a line having the following format -

From - <date>

The date is taken from when the script was executed. The examiner should be aware of this because the Transport Message Headers field will include it.

The mail data contained within converted Outlook message files will also be bookmarked.

Note that the script will not process deleted Outlook message files.

It's also important to note that the message-content will only be available if the entire message has been downloaded.

This script was developed for use in EnCase training. For more details, please click the following link:

• OpenText EnCase Training