Thunderbird mailbox parsing with Autopsy

Thunderbird is a free and open source mail client from Mozilla, the developers of the Firefox browser. If a user doesn't use Outlook, they are likely to use Thunderbird. In this recipe, we will show you how to extract data from Thunderbird MBOX files with a free and open source digital forensics platform — Autopsy.

Getting ready

Thunderbird stores mail data in MBOX files. These files can be found at the following location:

C:\Users\%USERNAME%\AppData\Roaming\Thunderbird\Profiles

Here you will find a user profile folder, which can be exported and processed with a piece of forensic software, in our case Autopsy.

Of course, you can use the whole forensic image for processing...