Export a mailbox for Email Discovery

What we accept

.mbox.zip.tar.gz.tgz

Up to 5 GB per file, measured on the mailbox unpacked rather than on the archive — a zip of mail is mostly base64 and commonly holds several times its own size. Upload as many files as the export produced; a large Takeout arrives as several numbered archives and they all belong in the same collection.

Nothing here ever asks for a mailbox password

Every route below is driven by the firm or the mailbox owner. If opposing counsel asks who collected the mailbox, “I exported it following the instructions” is an answer a firm can give; “the vendor logged into my client’s email” makes us part of the chain of custody in your own matter. We can sit on a screen share and guide you — see assisted export — but the firm drives.

Find your provider

Twenty-eight providers, five routes. The reason this is tractable is that fifty providers do not need fifty guides — they need mapping onto the handful of ways mail actually leaves a mailbox.

Route	Providers
Google Takeout	Gmail, Google Workspace (business Gmail)
The provider's own export	Proton Mail, Fastmail, Zoho Mail
Thunderbird over IMAP	Yahoo Mail, AT&T, BellSouth or SBCGlobal, Verizon, AOL Mail, iCloud Mail, Comcast or Xfinity, Cox, Spectrum, Charter, Time Warner or Roadrunner, Frontier, CenturyLink or EarthLink, GMX, Mail.com or Web.de, T-Online, Orange, Free.fr, SFR or Laposte, Libero, Virgilio or Tiscali, Terra, UOL or BOL, Yandex or Mail.ru, QQ Mail, NetEase (163 / 126), Naver or Daum, Rediffmail, A website host (GoDaddy, Bluehost, Namecheap, cPanel…), Another provider not listed here
Outlook	Outlook.com, Hotmail, Live or MSN, Microsoft 365 or Exchange
A compliance archive	A compliance archive (Mimecast, Proofpoint, Google Vault, Purview…)

A provider we cannot ingest yet is still listed with its remedy. An absence reads as “this tool does not handle my mail”, and somebody searching for their own provider has to find it.

Google Takeout

Gmail and Google Workspace. The provider has a real bulk export.

Applies to: Gmail, Google Workspace (business Gmail)

Go to takeout.google.com while signed in to the account that owns the mailbox.
Choose Deselect all, then tick Mail only.
Leave the format as MBOX and choose Export once, as a .zip.
Google emails a download link when the export is ready. A large mailbox can take hours to prepare.
Download every file Google gives you. A large export arrives as several numbered .zip files.
Upload the .zip files here exactly as you downloaded them — all of them, without unzipping anything.
Some of those files hold your mail and some hold only settings or an index page. You do not need to work out which: we read each one and tell you what was in it.
If you have already unzipped them, upload the .mbox files instead. Either way works — just do not mix a .zip and the .mbox that came out of it, or the same mail is counted twice.

The provider's own export

A handful of providers offer an export button in their settings.

Applies to: Proton Mail, Fastmail, Zoho Mail

Sign in to the mailbox and open its settings.
Look for Import & Export, Backup, or Export mailbox.
Export in MBOX or EML format if you are offered a choice.
Upload the file the provider gives you, exactly as downloaded.

Thunderbird over IMAP

No bulk export exists. This is most providers, by a wide margin.

Applies to: Yahoo Mail, AT&T, BellSouth or SBCGlobal, Verizon, AOL Mail, iCloud Mail, Comcast or Xfinity, Cox, Spectrum, Charter, Time Warner or Roadrunner, Frontier, CenturyLink or EarthLink, GMX, Mail.com or Web.de, T-Online, Orange, Free.fr, SFR or Laposte, Libero, Virgilio or Tiscali, Terra, UOL or BOL, Yandex or Mail.ru, QQ Mail, NetEase (163 / 126), Naver or Daum, Rediffmail, A website host (GoDaddy, Bluehost, Namecheap, cPanel…), Another provider not listed here

This provider has no bulk export of its own, so the mail is copied out with Mozilla Thunderbird — a free desktop email program. It becomes the export tool the provider never built.
Expect about twenty minutes of setup and then a WAIT. Thunderbird has to download the entire mailbox over IMAP, which for a few gigabytes of mail commonly takes several hours, and some providers deliberately slow it down.
First, if the account has two-factor authentication — Yahoo, AOL and iCloud all do by default — generate an APP PASSWORD in the provider's security settings. Thunderbird cannot sign in with the normal password when 2FA is on, and this is where most people get stuck.
Install Thunderbird and add the mailbox, using the app password if you made one. Choose IMAP rather than POP if you are asked: POP can delete mail from the server.
CRITICAL: open Account Settings → Synchronisation & Storage and tick "Keep messages in all folders for this account on this computer". Without it Thunderbird holds only message headers, and the export silently contains a fraction of the mail.
Right-click the account, choose Subscribe, and make sure every folder is ticked — including Archive, Sent, Spam and Trash if you need them.
Now let it download, and wait until it finishes. The status bar shows progress; leave the computer awake. Check the folder sizes against what you expect before going on.
Install the ImportExportTools NG add-on, then right-click the account and choose Export all folders to MBOX.
Upload the .mbox files it produces, or a .zip of them.
We will show you a message count for every file. Check those counts against what you expect the account to hold — we can prove we read everything in the file, but nothing can tell us whether the export captured the whole mailbox.

Outlook

Outlook exports PST, which cannot be read yet — so the mail comes out another way.

Applies to: Outlook.com, Hotmail, Live or MSN, Microsoft 365 or Exchange

Not ingestible as exported

Outlook.com, Hotmail, Live or MSN, Microsoft 365 or Exchange produce a format we cannot read yet. The steps below say what to do instead.

Outlook exports to PST, which we cannot read yet.
Until then, add the mailbox to Mozilla Thunderbird and export it to MBOX with the ImportExportTools NG add-on.
If the mailbox is on Microsoft 365, your IT administrator may be able to export MBOX or EML directly.

A compliance archive

Mail held by an IT department or an archiving product.

Applies to: A compliance archive (Mimecast, Proofpoint, Google Vault, Purview…)

Not ingestible as exported

A compliance archive (Mimecast, Proofpoint, Google Vault, Purview…) produce a format we cannot read yet. The steps below say what to do instead.

Mail held in a compliance archive is exported by whoever administers it.
Ask for an export in MBOX or EML format, covering the custodians and the date range you need.
Contact us if the archive only offers PST or a proprietary format and we will tell you whether we can read it.

Before you upload

We can prove we read every message in the files you upload, and we show a count for each one. We cannot know whether the export captured the whole mailbox — a folder left out, a message deleted before the export, or an IMAP download that stopped early all produce a short mailbox that we read perfectly. So check the per-file counts against what you expect the account to hold. “Inbox: 12 messages” from a ten-year account is obvious to you in a second and invisible to any arithmetic of ours.

If something goes wrong

Thunderbird will not sign in: Almost always two-factor authentication — Yahoo, AOL and iCloud all have it on by default, and Thunderbird cannot use the normal password when it is. Generate an app password in the provider’s security settings and use that. This is where most people get stuck at step one.
The export is far smaller than the mailbox: Thunderbird holds only message headers unless full synchronisation is on. Open Account Settings → Synchronisation & Storage and tick Keep messages in all folders for this account on this computer, let it finish downloading, then export again. Also use Subscribe to confirm every folder is ticked, including Archive, Sent, Spam and Trash.
“No mailbox found in this archive”: Three different causes. A Takeout export split into numbered parts, where the part you uploaded holds only settings — download and upload every numbered file, they are scanned together. Or Takeout’s archive_browser.html index page, which is not mail. Or Mail genuinely was not selected. The message on screen tells you which of the three it is, so read it before re-exporting: being told to tick Mail when Mail was already ticked costs an afternoon.
It is taking hours: Expected, and not something either side can speed up. The setup is about twenty minutes; the IMAP download that follows is commonly several hours for a few gigabytes, and some providers deliberately throttle it. Leave the computer awake.
My provider is not in the list: If it offers IMAP — nearly all do — the Thunderbird route works regardless of whether we have named it. Tell us and we will add it.