{"id":59281,"date":"2020-06-22T13:15:19","date_gmt":"2020-06-22T13:15:19","guid":{"rendered":"https:\/\/www.stellarinfo.com\/blog\/?p=59281"},"modified":"2024-08-20T05:50:46","modified_gmt":"2024-08-20T05:50:46","slug":"collecting-and-examining-gmail-mailboxes-for-forensic-investigation","status":"publish","type":"post","link":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/","title":{"rendered":"How to Examine Gmail Mailboxes for Email Forensics Investigation?"},"content":{"rendered":"<?xml encoding=\"utf-8\" ?><?xml encoding=\"utf-8\" ?><blockquote class=\"note_alert\">\n<p><strong>Summary<\/strong>: In this blog, we have examined Gmail mailboxes for Email Forensics Investigation. From data collection in Google Takeout and other Email Clients to forensic analysis of emails, we have discussed the said concepts in great detail. Following this, we discussed analyzing Gmail Mailbox activities.<\/p>\n<\/blockquote><p>Collecting and examining email data, from a cloud-based email service such as Gmail, for email forensics investigation can be tricky. This is because there is no direct way to export email data from Gmail. Also, the forensic techniques involved in Gmail mailbox examination go beyond the scope of the mailbox and cover additional sources such as the devices used, mobile apps accessed (if Android devices are used), etc. In this post, we discussed some techniques for collecting and examining Gmail mailboxes that can help you in email forensics investigation.&nbsp;<\/p><h2 class=\"wp-block-heading\" id=\"data-collection\"><strong>Data Collection<\/strong><\/h2><p>The first step in email forensics investigation is the collection of relevant data for analysis. There are two main ways to collect email data from a Gmail account:<\/p><ul class=\"wp-block-list\">\n<li><strong>Google Takeout:<\/strong> You can use Google Takeout to download an offline archive of the Gmail account.<\/li>\n\n\n\n<li><strong>Email Clients:<\/strong> You can use email clients such as Microsoft Outlook or Mozilla Thunderbird to use POP3\/IMAP synchronization and download emails from a Gmail account on your system.<\/li>\n<\/ul><h3 class=\"wp-block-heading\" id=\"h-1-google-takeout\"><strong>1. Google Takeout<\/strong><\/h3><p>Google Takeout, a service provided by Google, allows you to back up all the data of your Google account. It can also create a backup of Google Mail that includes all the messages and attachments in the account. This backup is generated in <strong>MBOX<\/strong> file format.&nbsp;<\/p><p>To use Google Takeout for exporting email data, follow the given steps:<\/p><p>1. Login with your Gmail account&rsquo;s credentials.<\/p><p>2. Select the checkbox of Mail [See <strong>Figure 1<\/strong>].<\/p><div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"497\" src=\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Google-Takeout-page-1024x497.png\" alt=\"Google Takeout Page\" class=\"wp-image-59292 apply-gradient-on-post-images\" srcset=\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Google-Takeout-page-1024x497.png 1024w, https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Google-Takeout-page-300x146.png 300w, https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Google-Takeout-page-768x373.png 768w, https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Google-Takeout-page.png 1364w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><strong><em>Figure 1:<\/em><\/strong><em> Google Takeout Page<\/em><\/figcaption><\/figure>\n<\/div><p><strong><em>Note:<\/em><\/strong><em> Clicking <strong>All Mail data included<\/strong> button opens more options to select\/deselect certain folders in the email database.<\/em><\/p><p>3. Click <strong>Next Step<\/strong> button at the bottom.<\/p><p>4. Export the data in .zip or .tgz compressed file (both files contain the MBOX file).<\/p><h3 class=\"wp-block-heading\" id=\"h-2-email-client\"><strong>2. Email Client<\/strong><\/h3><p>You can use email clients, such as Microsoft Outlook, Opera Mail, Mozilla Thunderbird, etc. to download emails from Gmail.<\/p><p>Gmail supports&nbsp;<em>IMAP<\/em>&nbsp;and&nbsp;<em>POP3<\/em>&nbsp;protocols to synchronize emails in an email client. &nbsp;<\/p><p>Let us understand the difference between IMAP and POP3 protocols, when using an email client. We are taking Microsoft Outlook as example.<\/p><p><strong><em>1. IMAP (Internet Message Access Protocol)<\/em><\/strong><\/p><p>In an IMAP account, emails are stored on an on-premises or cloud server. So, you can access your email account on multiple devices and read the messages across those devices. Changes made in the mailbox are also synchronized across all the devices in real-time.&nbsp;<\/p><p>Outlook with IMAP account uses Offline Storage Table or <strong>.OST<\/strong> file to store a synchronized copy of mailbox data on the local system. The location of OST file on your system is:<\/p><p class=\"has-text-align-center\"><strong><strong>%AppData%\\Local\\Microsoft\\Outlook<\/strong><\/strong><\/p><p><strong><em>2. POP3 (Post Office Protocol version 3)<\/em><\/strong><\/p><p>In a POP3 account, emails are downloaded and stored locally on your system. It means that emails are accessible only on a single device. Unlike IMAP accounts, there is no provision of synchronizing and accessing emails across multiple devices.<\/p><p>Outlook with POP account uses Personal Storage Table or <strong>.PST<\/strong> file to store the mailbox data. The location of this file on your system is:<\/p><p class=\"has-text-align-center\"><strong><strong>%UserRoot%\\Documents\\Outlook Files<\/strong><\/strong><\/p><h2 class=\"wp-block-heading\" id=\"forensic-analysis-of-emails\"><strong>Forensic Analysis of Emails<\/strong><\/h2><p>Once you collect the email data file (either directly or with an email client), you can load it into an email forensics software for further analysis.<\/p><p>You can start collecting the relevant emails by performing searches in the mailbox, based on keywords, names of suspected individuals, and event dates and times.<\/p><p class=\"has-very-light-gray-background-color has-background\">Looking for a reliable, fast, and powerful <strong><a href=\"https:\/\/www.stellarinfo.com\/email-forensics-software.php\" target=\"_blank\" rel=\"noreferrer noopener\">email forensics software<\/a><\/strong>? Try&nbsp;<strong>Stellar Email Forensic<\/strong>! It supports more than 25 email file formats like&nbsp;<strong><a href=\"https:\/\/www.stellarinfo.com\/blog\/forensic-analysis-of-exchange-edb-files\/\" target=\"_blank\" rel=\"noreferrer noopener\">EDB<\/a>,<\/strong>&nbsp;<strong><a href=\"https:\/\/www.stellarinfo.com\/blog\/essential-features-of-pst-forensic-tool\/\" target=\"_blank\" rel=\"noreferrer noopener\">PST<\/a><\/strong>,&nbsp;<strong>OST<\/strong>,&nbsp;<strong>MBOX<\/strong>, DBX, NSF, and OLM. It also offers deleted email recovery, case management tools, and many advanced search functions!&nbsp;<a href=\"https:\/\/www.stellarinfo.com\/email-forensics-software\/buy-now.php\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Download<\/strong><\/a>&nbsp;it today.<\/p><p><em><em><strong>Note:&nbsp;<\/strong><\/em>Don&rsquo;t use email clients like Outlook for performing searches. Use only enterprise-grade eDiscovery email forensic software. Read our blog post&nbsp;<\/em><a href=\"https:\/\/www.stellarinfo.com\/blog\/outlook-instant-search-for-email-investigations-or-discovery\/\" target=\"_blank\" rel=\"noreferrer noopener\"><em>Limitations of using Instant Search Outlook for Email Investigations<\/em><\/a><em>.<\/em><\/p><p>After gathering relevant emails, you can inspect them closely by studying their header fields.<\/p><h3 class=\"wp-block-heading\" id=\"h-email-header-analysis\"><strong>Email Header Analysis<\/strong><\/h3><p>Email header contains important details of the message which you can study to gather evidence and draw conclusions. These details include name and IP address of sender, ISP details, Message-ID, time-stamps of different servers that relayed the message, etc. [See&nbsp;<strong>Figure 2<\/strong>]<\/p><div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"608\" height=\"439\" src=\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Email-header-fields-in-Gmail.png\" alt=\"Email header fields in Gmail\" class=\"wp-image-59293 apply-gradient-on-post-images\" srcset=\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Email-header-fields-in-Gmail.png 608w, https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Email-header-fields-in-Gmail-300x217.png 300w\" sizes=\"auto, (max-width: 608px) 100vw, 608px\" \/><figcaption class=\"wp-element-caption\"><strong><em>Figure 2: <\/em><\/strong><em>Email header fields in Gmail<\/em><\/figcaption><\/figure>\n<\/div><p><em><em><em>To learn more about email headers, read&nbsp;<\/em><a href=\"https:\/\/www.stellarinfo.com\/article\/email-header-structure-forensic-analysis.php\" target=\"_blank\" rel=\"noreferrer noopener\"><em>Email Header Analysis and its application in Email Forensics<\/em><\/a><em>.<\/em><\/em><\/em><\/p><h2 class=\"wp-block-heading\" id=\"analyzing-gmail-mailbox-activities\"><strong><strong>Analyzing Gmail Mailbox Activities<\/strong><\/strong><\/h2><p>Apart from Gmail mailbox, you can focus on other sources to gather additional information. For instance, Google tracks and records all your online activities when you use a Google product, such as Google Search, Gmail, Google Drive, or Android OS. You can review the activities and associated details like time, device used, location, etc. by using a Google&rsquo;s service called&nbsp;<strong>My Activity<\/strong>&nbsp;[See&nbsp;<strong>Figure 3<\/strong>]. You can log in to&nbsp;<strong>My Activity<\/strong>&nbsp;using the same Gmail account to review associated activities.<\/p><div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"518\" src=\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Google-My-Activity-Page-1024x518.png\" alt=\"Google&rsquo;s My Activity Page\" class=\"wp-image-59294 apply-gradient-on-post-images\" srcset=\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Google-My-Activity-Page-1024x518.png 1024w, https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Google-My-Activity-Page-300x152.png 300w, https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Google-My-Activity-Page-768x388.png 768w, https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/Google-My-Activity-Page.png 1363w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><strong><em><em><strong>Figure 3:<\/strong>&nbsp;<\/em><\/em><\/strong><em><em>Google&rsquo;s My Activity Page<\/em><\/em><\/figcaption><\/figure>\n<\/div><p>Examining account activities in Google&rsquo;s&nbsp;<strong>My Activity<\/strong>&nbsp;can provide additional details about the user, such as history of search queries, recent logins and details of the sessions, and devices used. You can correlate this information with the email data to build a timeline of events that are related to the case.<\/p><h3 class=\"wp-block-heading\" id=\"h-conclusion\"><strong>Conclusion<\/strong><\/h3><p>From the techniques shared above, you can collect and examine Gmail mailbox data. Ideally, you should also refer to other data collected by Google such as Google apps data and devices data to correlate with the events that are documented in the case. This can help you to reconstruct the events that led to the investigation and connect the dots for accurate and fast resolution.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Summary: In this blog, we have examined Gmail mailboxes for Email Forensics&hellip; <a class=\"more-link\" href=\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/\">Continue reading <span class=\"screen-reader-text\">How to Examine Gmail Mailboxes for Email Forensics Investigation?<\/span><\/a><\/p>\n","protected":false},"author":39,"featured_media":59298,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1245],"tags":[3443,1240,3381,3410,1242,3391,3444,1448,1470,3445,733,3441,3442,2108,1982],"class_list":["post-59281","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-email-forensics","tag-analyze-gmail-mailbox","tag-email-forensics","tag-email-forensics-software","tag-email-header","tag-email-investigation","tag-forensic-analysis-of-email","tag-gmail-activity","tag-gmail-forensics","tag-google-takeout","tag-how-to-open-mbox-file","tag-import-mbox-to-pst","tag-mbox","tag-mbox-file-format","tag-mbox-format","tag-mbox-viewer","entry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to Examine Gmail Mailboxes for Email Forensics Investigation? | Stellar<\/title>\n<meta name=\"description\" content=\"A detailed guide on forensic analysis of Gmail mailboxes. Includes different techniques for collection and examination of mailboxes.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Examine Gmail Mailboxes for Email Forensics Investigation? | Stellar\" \/>\n<meta property=\"og:description\" content=\"A detailed guide on forensic analysis of Gmail mailboxes. Includes different techniques for collection and examination of mailboxes.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/\" \/>\n<meta property=\"og:site_name\" content=\"Stellar Data Recovery Blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-06-22T13:15:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-08-20T05:50:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/How-to-Collect-and-Examine-Gmail-Mailboxes-for-Forensic-Investigation-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Abhinav Sethi\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Abhinav Sethi\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/\"},\"author\":{\"name\":\"Abhinav Sethi\",\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/#\/schema\/person\/59813a3d157f4d3a68949bce854241f4\"},\"headline\":\"How to Examine Gmail Mailboxes for Email Forensics Investigation?\",\"datePublished\":\"2020-06-22T13:15:19+00:00\",\"dateModified\":\"2024-08-20T05:50:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/\"},\"wordCount\":1000,\"image\":{\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/How-to-Collect-and-Examine-Gmail-Mailboxes-for-Forensic-Investigation-1.jpg\",\"keywords\":[\"Analyze Gmail Mailbox\",\"email forensics\",\"email forensics software\",\"email header\",\"email investigation\",\"forensic analysis of email\",\"Gmail Activity\",\"gmail forensics\",\"google takeout\",\"how to open mbox file\",\"import mbox to pst\",\"mbox\",\"MBOX file format\",\"mbox format\",\"mbox viewer\"],\"articleSection\":[\"Email Forensics\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/\",\"url\":\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/\",\"name\":\"How to Examine Gmail Mailboxes for Email Forensics Investigation? | Stellar\",\"isPartOf\":{\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/How-to-Collect-and-Examine-Gmail-Mailboxes-for-Forensic-Investigation-1.jpg\",\"datePublished\":\"2020-06-22T13:15:19+00:00\",\"dateModified\":\"2024-08-20T05:50:46+00:00\",\"author\":{\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/#\/schema\/person\/59813a3d157f4d3a68949bce854241f4\"},\"description\":\"A detailed guide on forensic analysis of Gmail mailboxes. Includes different techniques for collection and examination of mailboxes.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#primaryimage\",\"url\":\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/How-to-Collect-and-Examine-Gmail-Mailboxes-for-Forensic-Investigation-1.jpg\",\"contentUrl\":\"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/How-to-Collect-and-Examine-Gmail-Mailboxes-for-Forensic-Investigation-1.jpg\",\"width\":1000,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.stellarinfo.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Examine Gmail Mailboxes for Email Forensics Investigation?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/#website\",\"url\":\"https:\/\/www.stellarinfo.com\/blog\/\",\"name\":\"Stellar Data Recovery Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.stellarinfo.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/#\/schema\/person\/59813a3d157f4d3a68949bce854241f4\",\"name\":\"Abhinav Sethi\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.stellarinfo.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/5f7b5067a858b11bbdea64a56366ad4f686cef22d39ccc50363bc5346e80a6de?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/5f7b5067a858b11bbdea64a56366ad4f686cef22d39ccc50363bc5346e80a6de?s=96&d=mm&r=g\",\"caption\":\"Abhinav Sethi\"},\"description\":\"Abhinav Sethi is a Senior Writer at Stellar. He writes articles, blog posts, knowledge-bases, case studies, etc. for different technologies. He also has a keen interest in digital forensics and helps forward-thinking companies fight different threats with apt solutions.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/abhinav-sethi-126b123a\/\"],\"url\":\"https:\/\/www.stellarinfo.com\/blog\/author\/abhinav\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Examine Gmail Mailboxes for Email Forensics Investigation? | Stellar","description":"A detailed guide on forensic analysis of Gmail mailboxes. Includes different techniques for collection and examination of mailboxes.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/","og_locale":"en_US","og_type":"article","og_title":"How to Examine Gmail Mailboxes for Email Forensics Investigation? | Stellar","og_description":"A detailed guide on forensic analysis of Gmail mailboxes. Includes different techniques for collection and examination of mailboxes.","og_url":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/","og_site_name":"Stellar Data Recovery Blog","article_published_time":"2020-06-22T13:15:19+00:00","article_modified_time":"2024-08-20T05:50:46+00:00","og_image":[{"width":1000,"height":600,"url":"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/How-to-Collect-and-Examine-Gmail-Mailboxes-for-Forensic-Investigation-1.jpg","type":"image\/jpeg"}],"author":"Abhinav Sethi","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Abhinav Sethi","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#article","isPartOf":{"@id":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/"},"author":{"name":"Abhinav Sethi","@id":"https:\/\/www.stellarinfo.com\/blog\/#\/schema\/person\/59813a3d157f4d3a68949bce854241f4"},"headline":"How to Examine Gmail Mailboxes for Email Forensics Investigation?","datePublished":"2020-06-22T13:15:19+00:00","dateModified":"2024-08-20T05:50:46+00:00","mainEntityOfPage":{"@id":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/"},"wordCount":1000,"image":{"@id":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#primaryimage"},"thumbnailUrl":"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/How-to-Collect-and-Examine-Gmail-Mailboxes-for-Forensic-Investigation-1.jpg","keywords":["Analyze Gmail Mailbox","email forensics","email forensics software","email header","email investigation","forensic analysis of email","Gmail Activity","gmail forensics","google takeout","how to open mbox file","import mbox to pst","mbox","MBOX file format","mbox format","mbox viewer"],"articleSection":["Email Forensics"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/","url":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/","name":"How to Examine Gmail Mailboxes for Email Forensics Investigation? | Stellar","isPartOf":{"@id":"https:\/\/www.stellarinfo.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#primaryimage"},"image":{"@id":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#primaryimage"},"thumbnailUrl":"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/How-to-Collect-and-Examine-Gmail-Mailboxes-for-Forensic-Investigation-1.jpg","datePublished":"2020-06-22T13:15:19+00:00","dateModified":"2024-08-20T05:50:46+00:00","author":{"@id":"https:\/\/www.stellarinfo.com\/blog\/#\/schema\/person\/59813a3d157f4d3a68949bce854241f4"},"description":"A detailed guide on forensic analysis of Gmail mailboxes. Includes different techniques for collection and examination of mailboxes.","breadcrumb":{"@id":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#primaryimage","url":"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/How-to-Collect-and-Examine-Gmail-Mailboxes-for-Forensic-Investigation-1.jpg","contentUrl":"https:\/\/www.stellarinfo.com\/blog\/wp-content\/uploads\/2020\/06\/How-to-Collect-and-Examine-Gmail-Mailboxes-for-Forensic-Investigation-1.jpg","width":1000,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/www.stellarinfo.com\/blog\/examining-and-collecting-gmail-mailboxes-for-forensic-investigation\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.stellarinfo.com\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Examine Gmail Mailboxes for Email Forensics Investigation?"}]},{"@type":"WebSite","@id":"https:\/\/www.stellarinfo.com\/blog\/#website","url":"https:\/\/www.stellarinfo.com\/blog\/","name":"Stellar Data Recovery Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.stellarinfo.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.stellarinfo.com\/blog\/#\/schema\/person\/59813a3d157f4d3a68949bce854241f4","name":"Abhinav Sethi","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.stellarinfo.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/5f7b5067a858b11bbdea64a56366ad4f686cef22d39ccc50363bc5346e80a6de?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5f7b5067a858b11bbdea64a56366ad4f686cef22d39ccc50363bc5346e80a6de?s=96&d=mm&r=g","caption":"Abhinav Sethi"},"description":"Abhinav Sethi is a Senior Writer at Stellar. He writes articles, blog posts, knowledge-bases, case studies, etc. for different technologies. He also has a keen interest in digital forensics and helps forward-thinking companies fight different threats with apt solutions.","sameAs":["https:\/\/www.linkedin.com\/in\/abhinav-sethi-126b123a\/"],"url":"https:\/\/www.stellarinfo.com\/blog\/author\/abhinav\/"}]}},"_links":{"self":[{"href":"https:\/\/www.stellarinfo.com\/blog\/wp-json\/wp\/v2\/posts\/59281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.stellarinfo.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.stellarinfo.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.stellarinfo.com\/blog\/wp-json\/wp\/v2\/users\/39"}],"replies":[{"embeddable":true,"href":"https:\/\/www.stellarinfo.com\/blog\/wp-json\/wp\/v2\/comments?post=59281"}],"version-history":[{"count":17,"href":"https:\/\/www.stellarinfo.com\/blog\/wp-json\/wp\/v2\/posts\/59281\/revisions"}],"predecessor-version":[{"id":172583,"href":"https:\/\/www.stellarinfo.com\/blog\/wp-json\/wp\/v2\/posts\/59281\/revisions\/172583"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.stellarinfo.com\/blog\/wp-json\/wp\/v2\/media\/59298"}],"wp:attachment":[{"href":"https:\/\/www.stellarinfo.com\/blog\/wp-json\/wp\/v2\/media?parent=59281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.stellarinfo.com\/blog\/wp-json\/wp\/v2\/categories?post=59281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.stellarinfo.com\/blog\/wp-json\/wp\/v2\/tags?post=59281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}