Pengaya
Selamat datang ke Pengaya Thunderbird.
Tambahkan fitur ekstra dan gaya untuk membuat Thunderbird milik anda.
Tutup
mboxSleuth 1.0.0
oleh mboxsleuth
Forensic email analysis toolkit for mbox files.
24 modules: social graph, entity extraction, keyword search, evidence tagging, noise suppression, header analysis, attachment hashing, and more.
All processing is local.
Tentang Pengaya ini
mboxSleuth is a forensic email analysis dashboard for Thunderbird. It provides 24 analysis modules for forensics investigators reviewing mbox files, e-discovery practitioners, and security researchers.
All processing is local — no data ever leaves your machine.
Modules
Orientation & Mbox Management
Search & Discovery
Categorization
Identity & Anomaly Detection
Deep Forensics & Export
Evidence Tagging
Right-click messages in Thunderbird to tag as EVIDENCE or EVIDENCE - HOT. Works with multi-select. Export tagged messages as mbox files from the Export Data module.
Key Features</h3>
Privacy
mboxSleuth processes all data locally. No data is transmitted to external servers. No analytics or telemetry is collected.
Requirements
Thunderbird 115 or later.
All processing is local — no data ever leaves your machine.
Modules
Orientation & Mbox Management
- Overview — Account identification, message statistics, top correspondents, busiest days, top domains
- Modify Mbox — Split mbox files by date, size, or count. Noise suppression removes newsletters and automated messages
- Volume Timeline — Interactive D3.js chart of message volume over time (daily/weekly/monthly)
- Social Graph — Force-directed network graph with heatmap coloring, directional arrows, date filtering, zoom/pan, and PNG export
- Domain Analysis — Sender/recipient domains ranked by frequency. Flags freemail and unusual TLDs
- Sending Patterns — Classifies messages as 1-to-1, 1-to-few, or 1-to-many (broadcast)
Search & Discovery
- Time Analysis — 24x7 activity heatmap and timezone inference
- Keyword Search — Full-text search with regex, email address filtering, and Thunderbird Quick Filter integration
- Word Map — Word frequency analysis with clickable word cloud and rare-word discovery
- Entity Extractor — Extracts phone numbers, SSNs, credit cards, crypto wallets (BTC, ETH, XMR, LTC, DASH, ZEC, DOGE, USDT), tracking numbers (USPS, UPS, FedEx, DHL, international), IP addresses, physical addresses, and more
- URL Analyzer — Flags shortened links, cloud storage, file-sharing services, and domain mismatches
Categorization
- Account Notifications — Detects password resets, 2FA codes, login alerts, purchase receipts, shipping, bookings, and more. Editable keyword list
- Auto-Taint — Attorney-client privilege detection. Editable keywords, email address taint list. Export or delete flagged messages
- English Detector — Classifies messages as English, Non-English, or Mixed
- Language & Locale — Script detection, currency symbols, date formats, spelling patterns
Identity & Anomaly Detection
- Signature Blocks — Extracts phone numbers, titles, addresses, and URLs from email signatures
- Ghost Detector — Finds deleted messages from broken thread references
- Header Anomalies — Spoofing, SPF/DKIM/DMARC failures, missing headers, future dates
- Client Fingerprint — Email client identification and change detection
Deep Forensics & Export
- Tech Headers — Header statistics: routing analysis, mail server census, authentication summary, originating IPs
- Fingerprints — EXIF extraction with GPS coordinates and Google Maps links. PDF and Office document metadata
- Attachments — SHA-256 hashing with duplicate detection. Download all as ZIP with manifest
- Multimedia — Gallery of images, audio, and video with inline playback. Download all as ZIP
- Export Data — Timeline CSV, contact database, full message export, evidence mbox export
Evidence Tagging
Right-click messages in Thunderbird to tag as EVIDENCE or EVIDENCE - HOT. Works with multi-select. Export tagged messages as mbox files from the Export Data module.
Key Features</h3>
- 24 analysis modules in a single dashboard
- Multi-folder and multi-account scanning
- CSV export on every module
- Thunderbird Quick Filter integration
- Paginated tables for large datasets
- Shared API cache for performance
- Dark mode
- All libraries bundled locally (D3.js, exif-js, JSZip)
Privacy
mboxSleuth processes all data locally. No data is transmitted to external servers. No analytics or telemetry is collected.
Requirements
Thunderbird 115 or later.
