Sherlock Forensics EML Viewer Open EML Files Without an Email Client

EML is the RFC-822 standard email format used by nearly every email system outside of Microsoft Outlook. Each .eml file is a plain-text document with MIME encoding that contains a single email message with full headers, body content and encoded attachments.

The format is human-readable at its core. Open any .eml file in a text editor and you will see the raw headers followed by the message body. MIME boundaries separate plain text from HTML content and base64-encoded attachments. This transparency makes EML the preferred format for forensic examination because nothing is hidden behind proprietary encoding.

EML files are produced by Thunderbird, Windows Mail, Gmail Takeout, forensic acquisition tools and email server exports. They are the most universal email format outside of Microsoft's ecosystem. Any tool that claims to handle email evidence must be able to parse EML correctly.

EML files appear in forensic casework and IT administration from a wide range of sources.

• Mozilla Thunderbird — default export format when saving or dragging messages from the client
• Google Takeout — Gmail export produces individual .eml files for every message in the archive
• Forensic acquisition tools — X-Ways, Autopsy and FTK extract email artifacts as .eml files from disk images
• IMAP client downloads — programmatic IMAP fetch operations save messages in EML format
• Email server backups and migrations — Postfix, Dovecot and other MTAs store mail as individual EML files in Maildir format
• Incident response evidence collection — suspicious emails forwarded as attachments arrive as .eml files
• Court-ordered email productions — opposing counsel or service providers may produce email evidence in EML format

Sherlock Forensics EML Viewer applies the same forensic rigor to .eml files that examiners expect from enterprise forensic suites. Every EML opened receives an automatic forensic readout alongside the standard message preview.

SMTP Transport Chain

Every Received: header in the EML file is parsed into a chronological hop-by-hop trail. Each entry shows the sending host, receiving host, IP address and protocol used. The viewer reconstructs the complete path from origin to destination, presenting a single-line summary that answers "where did this message actually come from" at a glance. Forged headers and inconsistent timestamps are visible immediately when the full chain is laid out in sequence.

Authentication Results

SPF, DKIM and DMARC verdicts are extracted from the Authentication-Results header and displayed with plain-English explanations. A passing SPF result means the sending IP was authorized by the domain owner. A valid DKIM signature confirms the message body was not altered in transit. DMARC alignment ties SPF and DKIM together under the sender's domain policy. When any of these checks fail, the viewer flags the result and explains what the failure means in practical terms.

Anomaly Detection

The viewer automatically flags suspicious patterns in every EML file. Missing sender addresses, authentication failures, Message-ID domains that do not match the From: domain, unusual header ordering and other indicators are surfaced without requiring the examiner to read raw headers manually. These flags serve as triage markers when processing large volumes of email evidence.

Raw Headers

One click exposes the full RFC-822 headers for independent verification. Every header field is displayed exactly as stored in the .eml file with no parsing or reformatting applied. This allows examiners to verify the tool's automated analysis against the raw source data or to identify header fields that fall outside standard automated checks.

Point the viewer at a directory of EML files and every message becomes a browsable list. Folder mode supports optional recursive scanning for nested subdirectories, which is essential when processing forensic disk images or email server exports that organize messages in deep folder hierarchies.

Sort the loaded messages by sender, date, subject or anomaly flags. Check off messages that require further examination. The anomaly column provides immediate visual triage: messages with authentication failures or suspicious header patterns rise to the top without manual review of each file.

This capability is particularly valuable for Gmail Takeout archives. A single Google Takeout export can produce thousands of individual EML files spread across label-based folder structures. Folder mode with recursive scanning loads the entire export in one operation. The transport chain analysis on each message reveals whether forwarded emails were actually forwarded by Gmail's servers or fabricated after the fact.

Free Edition ($0)

Read any EML file or folder of EML files. View message body and attachments inline. Full forensic analysis including SMTP transport chain visualization, SPF/DKIM/DMARC authentication results and anomaly detection. SHA-256 hashing for every file opened. Chain of custody logging. No trial period. No feature expiry.

Forensic Edition ($67 USD)

Everything in the free edition plus byte-level attachment extraction with per-attachment SHA-256 hashing. Court-ready PDF forensic reports with per-message hash verification and sender IP attribution. Mbox export for archival. Priority email support. One-time payment with no subscription.