{
  "fileFormatID": 1519,
  "formatName": "MBOX",
  "version": null,
  "formatDescription": "MBOX is a commonly used format for storing email messages. MBOX files may be produced by a variety of email clients, however these are often not mutually compatible. \r\n\r\nMBOX databases typically contain a linear sequence of electronic mail messages. Each message begins with a separator line that identifies the message sender, and also identifies the date and time at which the message was received by the final recipient (either the last-hop system in the transfer path, or the system which serves as the recipient's mailstore).  Each message is typically terminated by an empty line.  The end of the database is usually recognized by either the absence of any additional data, or by the presence of an explicit end-of-file marker. \r\n\r\nAttachments within MBOX files are typically base 64 encoded, allowing binary data to be transferred over media designed to deal with textual data. \r\n\r\nDue to the variety of MBOX structures, it is not currently possible to produce an authoritative signature for the format.",
  "releaseDate": null,
  "binaryFileFormat": null,
  "formatNote": null,
  "lastUpdatedDate": "02 Sep 2026",
  "formatProvenance": "\tv.123- New signature created. Submitted by Preservica; v.125- Priority over fmt/950 MIME Email 1.0 added. Submitted by Preservica.",
  "formatSourceDate": "12 Feb 2015",
  "formatDisclosure": null,
  "formatEnvironment": null,
  "formatRisk": null,
  "formatAliases": null,
  "formatTypes": "Text (Structured)",
  "formatFamilies": null,
  "identifiers": [
    {
      "identifierText": "application/mbox",
      "identifierType": "MIME"
    },
    {
      "identifierText": "fmt/720",
      "identifierType": "PUID"
    }
  ],
  "internalSignatures": [
    {
      "signatureID": 3460,
      "name": "MBOX",
      "note": "Based on https://www.rfc-editor.org/rfc/rfc4155, BOF: ASCII string 'From ' , followed by a {1-255} wildcard in place of a sender identifier or system message, followed by a ctime-format timestamp comprising an English-language three-character weekday abbreviation (Mon|Tue|Wed|Thu|Fri|Sat|Sun), three-character month abbreviation (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec), day-of-month digit, and time in HH:MM:SS format.",
      "byteSequences": [
        {
          "positionType": "Absolute from BOF",
          "offset": 0,
          "maxOffset": 0,
          "byteSequence": "46726F6D20{1-255}(4D6F6E|547565|576564|546875|467269|536174|53756E)20{0-2}(4A616E|466562|4D6172|417072|4D6179|4A756E|4A756C|417567|536570|4F6374|4E6F76|446563)20{0-2}[30:39]20[30:32][30:39]3A[30:35][30:39]3A[30:35][30:39]",
          "endianness": null,
          "byteSequenceID": 3854
        }
      ],
      "provenance": "Note that this identification pattern has been tested with Gmail and Thunderbird-produced MBOX files and should suit all MBOX files produced following the established UNIX pattern described here: http://qmail.org./man/man5/mbox.html however there may be other variants that differ in implementation."
    }
  ],
  "externalSignatures": [
    {
      "externalSignature": "mbox",
      "signatureType": "File extension"
    }
  ],
  "relationships": [
    {
      "relationshipType": "Has priority over",
      "relatedFormatID": 1755,
      "relatedFormatName": "MIME Email",
      "relatedFormatPUID": "fmt/950"
    }
  ],
  "containerSignatures": [],
  "submittedBy": [
    1
  ]
}