PGP Encrypted MBOX emails

Digital Forensics
1

Is there a tool or method to do a bulk decryption of PGP-encrypted emails in the MBOX container and export decrypted emails?

I have the private key and the password. Tried to do it in NUIX but it is painfully slow.

2

FEI should work for what you are looking to do. Ingests Mbox, decrypts PGP, and can export the decrypted emails as MIME messages.

3

Arman, how is the throughput for FEI? We have around 2 million emails for 30+ custodians.

4

Depends on your system and the messages you will be ingesting. Just to give you a very rough idea, a recent test we ran on a fairly modest forensic laptop showed ~950,000 messages/hour on the ingestion side from Mbox files. This is without the Insights processing (i.e., DKIM & ARC verification, etc.).

5

  1. Can´t you read this mbox in a client like Mozilla Thunderbird and then export the decoded messages to another mbox?

  2. If you´re familiar with python, you might try https://gitlab.com/kenogo/mbdecrypt, or some similar code.
    But e-mails messages may be tricky for dealing in a low-level approach and you may get stuck working with data conversions, escape characters, urls decoding and so on.