# Latest **URL:** https://community.metaspike.com/latest.md [Latest](https://community.metaspike.com/latest.md) · [Categories](https://community.metaspike.com/categories.md) · [Tags](https://community.metaspike.com/tags.md) --- ## [Welcome to Metaspike Community!](https://community.metaspike.com/t/welcome-to-metaspike-community/7)
**Author:** [@system](https://community.metaspike.com/u/system)\ **Replies:** 0\ **Last updated:** [December 13, 2019, 5:47pm UTC](https://community.metaspike.com/t/welcome-to-metaspike-community/7 "2019-12-13T17:47:30Z")
Welcome to the Metaspike Community! This community is open to everyone to discuss digital forensics regardless of whether or not you are a Metaspike user. Join the conversation to share your experiences, tips and tricks,… --- ## [Does your program convert mbox files to pst files?](https://community.metaspike.com/t/does-your-program-convert-mbox-files-to-pst-files/2749)
**Author:** [@williamson192](https://community.metaspike.com/u/williamson192)\ **Replies:** 1\ **Last updated:** [September 11, 2026, 10:04pm UTC](https://community.metaspike.com/t/does-your-program-convert-mbox-files-to-pst-files/2749 "2026-09-11T22:04:43Z")
We occasionally receive mbox files in productions and need a way to review them in Outlook. Will either of your programs convert these to PST? --- ## [Conversation Index Analysis in Email Forensics — Part 2](https://community.metaspike.com/t/conversation-index-analysis-in-email-forensics-part-2/2721)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [July 31, 2026, 12:57am UTC](https://community.metaspike.com/t/conversation-index-analysis-in-email-forensics-part-2/2721 "2026-07-31T00:57:51Z")
Published a new blog on our website to cover “modern” Conversation Indices and go over how we calculate child block timestamps that overflow. You can read it here: Part 2 was 13 years after Part 1. Let’s hope Part 3 w… --- ## [Help decoding Thread-Index value from Outlook 14 (2010)](https://community.metaspike.com/t/help-decoding-thread-index-value-from-outlook-14-2010/2711)
**Author:** [@mspencer](https://community.metaspike.com/u/mspencer)\ **Replies:** 1\ **Last updated:** [July 28, 2026, 8:46pm UTC](https://community.metaspike.com/t/help-decoding-thread-index-value-from-outlook-14-2010/2711 "2026-07-28T20:46:27Z")
Hello All, Have any of you had success extracting timestamps from the following Thread-Index value format? AQIzIBmai4oAF1tNfCETKP0sI5Z3/g== I have now tried a few different methods of manually extracting and decoding … --- ## [Strange Email Behavior](https://community.metaspike.com/t/strange-email-behavior/2595)
**Author:** [@ysorokin](https://community.metaspike.com/u/ysorokin)\ **Replies:** 1\ **Last updated:** [January 29, 2026, 6:18pm UTC](https://community.metaspike.com/t/strange-email-behavior/2595 "2026-01-29T18:18:34Z")
I’m analyzing a PST exported from a user’s mailbox in Company A’s M365 tenant. I’m seeing a pattern where: The display name in Outlook shows the mailbox owner (Custodian A). But when I click the name, Outlook reso… --- ## [Forensic Email Intelligence 2.2.658 Release Notes](https://community.metaspike.com/t/forensic-email-intelligence-2-2-658-release-notes/2578)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [December 22, 2025, 9:43pm UTC](https://community.metaspike.com/t/forensic-email-intelligence-2-2-658-release-notes/2578 "2025-12-22T21:43:15Z")
We have released a new version of FEI recently with a few key improvements :smiling\_face: Additional IP Intel Details We have added a few new data points to FEI’s IP Intelligence. Risk Snapshot: This is a risk value be… --- ## [Free Mailbox Sanitization Software—Obliterator](https://community.metaspike.com/t/free-mailbox-sanitization-software-obliterator/20)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 16\ **Last updated:** [November 25, 2025, 7:34pm UTC](https://community.metaspike.com/t/free-mailbox-sanitization-software-obliterator/20 "2025-11-25T19:34:21Z")
--- ## [Proton Mail Email Alterations](https://community.metaspike.com/t/proton-mail-email-alterations/2499)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [September 3, 2025, 7:21pm UTC](https://community.metaspike.com/t/proton-mail-email-alterations/2499 "2025-09-03T19:21:15Z")
I was playing with Proton Mail for some new FEI Insights, and discovered that it is altering MIME message contents very significantly upon receipt. If you are a Proton Mail user and have some insights, I would be interes… --- ## [Best tool for PDF Forensics](https://community.metaspike.com/t/best-tool-for-pdf-forensics/1090)
**Author:** [@nnn](https://community.metaspike.com/u/nnn)\ **Replies:** 7\ **Last updated:** [August 20, 2025, 3:46pm UTC](https://community.metaspike.com/t/best-tool-for-pdf-forensics/1090 "2025-08-20T15:46:58Z")
Hello, Looking for good PDF tool to analyze who is the author of the PDF file and modifications made for e-filling acknowledgement during few days span … --- ## [X-Apple-MoveToFolder Header](https://community.metaspike.com/t/x-apple-movetofolder-header/2481)
**Author:** [@SMELB](https://community.metaspike.com/u/SMELB)\ **Replies:** 1\ **Last updated:** [August 13, 2025, 6:57pm UTC](https://community.metaspike.com/t/x-apple-movetofolder-header/2481 "2025-08-13T18:57:10Z")
Hi all, I have a PST of a mailbox (AAA@corp.com) exported from Google Vault. Within the PST I have several emails with the following tags in the header: X-Apple-MoveToFolder: INBOX X-Apple-Action: MOVE\_TO\_FOLDER/INBOX … --- ## [Forensic Email Collector 4.1.507 Release Notes](https://community.metaspike.com/t/forensic-email-collector-4-1-507-release-notes/2474)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [August 1, 2025, 6:34pm UTC](https://community.metaspike.com/t/forensic-email-collector-4-1-507-release-notes/2474 "2025-08-01T18:34:56Z")
Happy to announce a couple of important quality of life improvements in FEC :grin: Modern Attachment Staging This new feature is an extension of modern attachment packaging, and provides the option to combine the parent… --- ## [Creating a VHDX container](https://community.metaspike.com/t/creating-a-vhdx-container/2454)
**Author:** [@Almar](https://community.metaspike.com/u/Almar)\ **Replies:** 1\ **Last updated:** [July 18, 2025, 2:53pm UTC](https://community.metaspike.com/t/creating-a-vhdx-container/2454 "2025-07-18T14:53:53Z")
Hello all, I like the option in FEC in containerize to a VHDX. At our office we have use-case to containerize a folder/directory to a VHDX. I found the sys-internals tool Disk2Vhd. But does someone knows how I can co… --- ## [How to Prove That An Email Was Received](https://community.metaspike.com/t/how-to-prove-that-an-email-was-received/2429)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 1\ **Last updated:** [June 27, 2025, 12:28am UTC](https://community.metaspike.com/t/how-to-prove-that-an-email-was-received/2429 "2025-06-27T00:28:33Z")
Just published a new blog on our website on proving email receipt in forensic investigations. You can read it here: I would be interested to hear what other strategies you use in similar scenarios. :grin: --- ## [Forensic Email Intelligence 2.2.472 Release Notes](https://community.metaspike.com/t/forensic-email-intelligence-2-2-472-release-notes/2418)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [June 17, 2025, 12:25am UTC](https://community.metaspike.com/t/forensic-email-intelligence-2-2-472-release-notes/2418 "2025-06-17T00:25:24Z")
FEI 2.2.472 is out with a long list of improvements! Here are the highlights :blush: Sender Policy Framework (SPF) FEI’s Domain Intel now includes SPF verification. This is often helpful when evaluating DMARC in light… --- ## [Remote Authenticator for Mac 2.2.0 Release Notes](https://community.metaspike.com/t/remote-authenticator-for-mac-2-2-0-release-notes/2405)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [May 28, 2025, 6:56pm UTC](https://community.metaspike.com/t/remote-authenticator-for-mac-2-2-0-release-notes/2405 "2025-05-28T18:56:45Z")
A new version of Remote Authenticator for macOS is now available! :flexed\_biceps:t2: Here is what’s new: DMG Deployment Remote Authenticator is now deployed in a DMG container with a launcher that allows the end-user… --- ## [Home network connection from a mobile device](https://community.metaspike.com/t/home-network-connection-from-a-mobile-device/2337)
**Author:** [@matt4700](https://community.metaspike.com/u/matt4700)\ **Replies:** 1\ **Last updated:** [April 21, 2025, 9:01pm UTC](https://community.metaspike.com/t/home-network-connection-from-a-mobile-device/2337 "2025-04-21T21:01:22Z")
A mobile phone number connected to our home network in the early morning hours, and I am seeking the mobile phone number or the IMEI of the mobile phone in question. My internet provider told me they had “limited” resour… --- ## [Forensic Email Collector 4.0.287 Release Notes](https://community.metaspike.com/t/forensic-email-collector-4-0-287-release-notes/2232)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [December 13, 2024, 11:32pm UTC](https://community.metaspike.com/t/forensic-email-collector-4-0-287-release-notes/2232 "2024-12-13T23:32:19Z")
We’ve just released a new FEC version with a major new feature: a new enterprise authentication method! :grin: Each time we released a new enterprise authentication method in the past, such as delegate access, impersona… --- ## [Looking for an Experienced Forensic Analyst](https://community.metaspike.com/t/looking-for-an-experienced-forensic-analyst/2333)
**Author:** [@downstreemllc](https://community.metaspike.com/u/downstreemllc)\ **Replies:** 0\ **Last updated:** [April 8, 2025, 9:57pm UTC](https://community.metaspike.com/t/looking-for-an-experienced-forensic-analyst/2333 "2025-04-08T21:57:17Z")
We would love to have you join our digital forensics team at Downstreem. We are a young company based in Phoenix, AZ, full of enthusiasm and a premier forensics company in the industry. What we are looking for is an exp… --- ## [Forensic Collection of Websites](https://community.metaspike.com/t/forensic-collection-of-websites/800)
**Author:** [@caseyl4n6](https://community.metaspike.com/u/caseyl4n6)\ **Replies:** 7\ **Last updated:** [March 10, 2025, 10:49pm UTC](https://community.metaspike.com/t/forensic-collection-of-websites/800 "2025-03-10T22:49:48Z")
I have been asked to capture an entire website. couple of single pages would’ve been no problem but not sure how to forensically capture an entire site (so many pages) in a defensible way. Does anyone have suggestions? … --- ## [Have you ever seen a TA delete the Outlook Rules Organizer?](https://community.metaspike.com/t/have-you-ever-seen-a-ta-delete-the-outlook-rules-organizer/1785)
**Author:** [@BriWolf](https://community.metaspike.com/u/BriWolf)\ **Replies:** 2\ **Last updated:** [February 12, 2025, 7:13pm UTC](https://community.metaspike.com/t/have-you-ever-seen-a-ta-delete-the-outlook-rules-organizer/1785 "2025-02-12T19:13:31Z")
The title, essentially. It appears to be an anti-forensics measure. The only thing I can think of is it would prevent recovery of deleted rules. Any thoughts/experiences? --- ## [MIME Boundary field meaning & decoding in email header(mail.com web client)](https://community.metaspike.com/t/mime-boundary-field-meaning-decoding-in-email-header-mail-com-web-client/2201)
**Author:** [@maminian](https://community.metaspike.com/u/maminian)\ **Replies:** 0\ **Last updated:** [November 9, 2024, 6:55am UTC](https://community.metaspike.com/t/mime-boundary-field-meaning-decoding-in-email-header-mail-com-web-client/2201 "2024-11-09T06:55:32Z")
Dear All As we know some important information can be found in MIME Boundary field in email headers. Such as the one described in this nice & interesting link (Dates in Hiding Part 2 — Gmail MIME Boundary Timestamps\] D… --- ## [Rich URL links in KIK](https://community.metaspike.com/t/rich-url-links-in-kik/2192)
**Author:** [@ssforensic](https://community.metaspike.com/u/ssforensic)\ **Replies:** 0\ **Last updated:** [November 5, 2024, 9:54am UTC](https://community.metaspike.com/t/rich-url-links-in-kik/2192 "2024-11-05T09:54:45Z")
Hi all, When a rich url link is shared, kik creates a preview of it. When this is received on another device, does anyone know where or what folder kik saves the thumbnail image/media when a rich url web link is receiv… --- ## [.MSG file forensic analysis](https://community.metaspike.com/t/msg-file-forensic-analysis/2160)
**Author:** [@DanielMouly](https://community.metaspike.com/u/DanielMouly)\ **Replies:** 3\ **Last updated:** [October 22, 2024, 4:46pm UTC](https://community.metaspike.com/t/msg-file-forensic-analysis/2160 "2024-10-22T16:46:23Z")
Dear all, I have some .msg email files that I suspect to have been forged/corrupted (i.e. contents modified in Outlook before being exported). What is the best way/tool to extract all the cryptic metadata and attribute… --- ## [Real IP address of the sender](https://community.metaspike.com/t/real-ip-address-of-the-sender/2167)
**Author:** [@maminian](https://community.metaspike.com/u/maminian)\ **Replies:** 0\ **Last updated:** [October 19, 2024, 5:34am UTC](https://community.metaspike.com/t/real-ip-address-of-the-sender/2167 "2024-10-19T05:34:03Z")
Dear all I have a question about sender IP address that is written in email headers. If we know that this IP is not correct and valid (it means email was sent with using VPN) Is there any method to find out the real I… --- ## [Kik urldata folder](https://community.metaspike.com/t/kik-urldata-folder/2151)
**Author:** [@ssforensic](https://community.metaspike.com/u/ssforensic)\ **Replies:** 0\ **Last updated:** [October 5, 2024, 9:05am UTC](https://community.metaspike.com/t/kik-urldata-folder/2151 "2024-10-05T09:05:32Z")
Dear Metaspike forum, Thank you for taking your time to read this message, I am doing some research into how the Kik application was built and how the application works. I am writing to you to ask if anyone has an answe… --- ## [DKIM Supercache](https://community.metaspike.com/t/dkim-supercache/2126)
**Author:** [@Marco](https://community.metaspike.com/u/Marco)\ **Replies:** 4\ **Last updated:** [September 24, 2024, 7:08am UTC](https://community.metaspike.com/t/dkim-supercache/2126 "2024-09-24T07:08:13Z")
Hi everyone! I’m wondering if there’s any documentation available about the development of the DKIM Supercache. Thanks! --- ## [.RPMSG encryption](https://community.metaspike.com/t/rpmsg-encryption/599)
**Author:** [@joshua\_smith62](https://community.metaspike.com/u/joshua_smith62)\ **Replies:** 2\ **Last updated:** [July 19, 2024, 6:56pm UTC](https://community.metaspike.com/t/rpmsg-encryption/599 "2024-07-19T18:56:14Z")
Good Evening everyone, Got forwarded a request see what i could do with an outlook file that was encrypted. the file is an .RPMSG file. Does anyone have any good experience they can share regarding this type of encrypti… --- ## [Forensic Email Intelligence 2.2 Release Notes](https://community.metaspike.com/t/forensic-email-intelligence-2-2-release-notes/2059)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [July 10, 2024, 8:00pm UTC](https://community.metaspike.com/t/forensic-email-intelligence-2-2-release-notes/2059 "2024-07-10T20:00:49Z")
We have just released FEI 2.2! This release contains some interesting new features, and we have put together a short video to demonstrate them (~4.5 minutes). :smiley: The MAPI comparison capability has be… --- ## [Video file meta data timestamps query](https://community.metaspike.com/t/video-file-meta-data-timestamps-query/2051)
**Author:** [@SebD](https://community.metaspike.com/u/SebD)\ **Replies:** 0\ **Last updated:** [July 4, 2024, 1:15pm UTC](https://community.metaspike.com/t/video-file-meta-data-timestamps-query/2051 "2024-07-04T13:15:19Z")
Please would someone with greater knowledge than I have take a quick look at the following meta data attached to a video recorded on a Samsung Smart-Phone and let me know your opinion? I have another video file produced… --- ## [Forensic Email Collector 4.0.110 Release Notes](https://community.metaspike.com/t/forensic-email-collector-4-0-110-release-notes/2038)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [June 21, 2024, 8:04pm UTC](https://community.metaspike.com/t/forensic-email-collector-4-0-110-release-notes/2038 "2024-06-21T20:04:13Z")
We have released a new version of FEC 4 this week. This update improves FEC’s Direct Drive acquisition workflow and adds a few quality of life improvements :grin: Fetch Only the Latest Revision before Target Date Acquir… [Next page](https://community.metaspike.com/latest.md?page=1)