SysTools Mozilla Thunderbird Forensics Tool

Loading of Evidence

Loading the Thunderbird MBOX files is the very first step of investigation for which the software offers an interactive dashboard & smooth process. It helps in quick creation of the cases to begin the evidence analyses.

• Create Cases - Get the best experience for creating single or multiple cases quickly for easy management of the cases without any single error at all.
• Hash Settings - Multiple hash settings i.e. MD5, SHA1, and SHA256 are available in the Mozilla Thunderbird forensics software for users.
• File Scanning - Modes like log unprocessed items, logs at case path, uploading attachments while scanning, etc are crucial for advanced file scanning.

Previewing Evidence

To preview the Thunderbird emails after adding them to the software, there are plenty of preview modes available with customization as well. Viewing data from different viewpoints is a boost for Forensic investigators.

• Preview Options - Preview all the data files like emails, calendars, etc with properties, messages, message header, RTF, HEX, MIME, & HTML modes.
• Attachments View - To not miss out on the attachments of the emails in Mozilla Thunderbird, Attachments Preview mode is quite useful.
• Custom Columns - MD5, sent, received to, from, subject, etc are the properties that allow investigators to select or deselect customized columns.

The Search Types

This Thunderbird email forensics software provides multiple search types to the digital forensicators for examining the Thunderbird emails.

• Search Types - General search, regular expression, proximity search wildcard search, fuzzy search, etc are some of the features for effective investigation.
• Search Filters - The Thunderbird forensics tool offers plenty of filters for searching specific emails from a bunch of files like tags filter, keyword filter, etc.
• Search Language - Emails in multiple languages can be examined with ease with the help of the Multi-lingual search feature of this advanced software.

Evidence Analyses

Now, when it comes to the analyses of evidence in the MBOX file, the major features start playing a key role to find the hidden links & information.

• Link Analysis - The software offers the flagship Link Analysis feature which is capable of providing links between Email IDs, IPs, & Domain in use.
• Word Cloud - Another helpful feature is the Word Cloud. This shows a bunch of the most discussed words in the selected emails of Thunderbird email clients.
• Timeline Analysis - Another major feature of this email forensic utility is to analyze the timeline of single or multiple emails to boost the investigation.

Evidence Export

Now, to present the evidence in a court of law, board meetings & other required platforms, It’s significant for users to export the emails in their preferred file formats. For this, the Thunderbird email forensics utility allows exporting the evidence in EML, MSG, PST, CSV, TIFF, DAT, PDF, HTML, etc file formats without any difficulties.

Status Report Generation

Last but not least, having a status report for the entire investigation is crucial. It basically explains the overview of the entire Thunderbird email forensics analysis findings in short. The software prepares the report in CSV & PDF file format which pretty much explains everything that is required without missing out on anything.