:: Training

:: Mailing List
News and updates:

Subscribe here

:: Contact

Contact Us

Email: info@filesig.co.uk

Post: Filesig Software,
PO Box 678,
YO26 0FU

WindowsMail.MSMessageStore Primer

Windows Mail is client based software for email and newsgroup management and was introduced with Microsoft Windows Vista. It is accessible on a Vista platform from the Start Menu under Programs.

This short article covers the file WindowsMail.MSMessageStore, part of the Windows Mail repository for email storage and archiving.

When using Windows Mail on a regular basis the user will be prompted to compact the message store upon program closure.

Windows Mail Compress

The process takes several minutes depending on the quantity of messages.

Windows Mail Compress Progress

The settings relating to the message store can be accessed and viewed from the main menu of Windows Mail under Tools > Options, then click the Advanced tab and Maintenance button (see picture below).

Windows Mail Settings

The maintenance window provides several pieces of information.

Windows Mail Settings

The default setting for prompting a user to compress the message store is 100 runs (see picture above). If this setting is changed to 1 for example the user would be prompted to compress the message store each time Windows Mail is closed.

The clean up window shows the current size of the message store and allows a user to perform general cleaning tasks. The picture below shows the message store is 78 megabytes.

Windows Mail Cleanup

The message store folder window displays the current path setting for the message store, the default location is:

\Users\\AppData\Local\Microsoft\Windows Mail

Windows Mail Store Location
Windows Mail Store Folder

Reviewing email and attachments from Windows Mail can be easily achieved by creating a virtual machine of the host system and using the Windows Mail application to view and export information.1

A utility called Windows Mail Store Extractor, part of Simple Carver Suite, will parse this data and provide a user with a summary of data contained within the WindowsMail.MSMessageStore.

Windows Mail Message Store Extractor

1 Commercial forensic packages Encase, FTK etc support processing of .eml files and associated attachments (not covered in this article).