Navigating the Windows Mail database

Research output: Contribution to journalArticlepeer-review

Full text download(s)

Published copy (DOI)



Publication details

JournalDigital Investigation
DateAccepted/In press - 4 Feb 2018
DateE-pub ahead of print (current) - 21 Mar 2018
Number of pages23
Pages (from-to)1-23
Early online date21/03/18
Original languageEnglish


The Extensible Storage Engine (ESE) database is used to support many forensically important applications in the Windows operating system, and a study of how ESE is used in one application provides wider insights into data storage in other current and future applications. In Windows 10, WindowsMail uses an ESE database to store messages, appointments and related data; however, field (column) names used to identify these records are hexadecimal property tags, many of which are undocumented. To support forensic analysis a series of experiments were carried out to identify the function of these tags, and this work resulted in a body of related information about the Mail application. This paper documents property tags that have been mapped, and presents how Windows Mail artifacts recovered from the ESE store.vol database can be interpreted, including how the paths of files recorded by the Mail system are derived from database records. We also present examples that illustrate forensic issues in the interpretation of email messages and appointment records, and show how additional information can be obtained by associating these records with other information in the ESE database.

Bibliographical note

© 2018 Elsevier Ltd. All rights reserved. This is an author-produced version of the published paper. Uploaded in accordance with the publisher’s self-archiving policy.

    Research areas

  • Windows Mail Email Message Appointment Calendar ESE Database store.vol Unistore ESECarve

Discover related content

Find related publications, people, projects, datasets and more using interactive charts.

View graph of relations