MBOX Archive Inventory, Duplicate & Attachment Auditor

What this auditor checks

The scanner recognizes conservative From envelope separators, records every message byte range, unfolds message headers, decodes common RFC 2047 encoded words for display, normalizes readable dates, and inventories recursive MIME parts. Multipart boundaries, closing delimiters, Content-Type syntax, Base64, quoted-printable, filenames, transfer sizes, and attachment dispositions receive exact findings.

Duplicate evidence is deliberately narrow. A SHA-256 group means the preserved RFC-message bytes match. A repeated Message-ID is shown separately and does not imply identical content. The tool does not apply fuzzy text similarity, delete duplicates, or choose a canonical copy.

MBOX separators are not universal

RFC 4155 registers application/mbox and documents a default format, while also noting that separator and quoting behavior varies across implementations. This tool requires a line beginning with From , a plausible following header, and—after the first record—a preceding blank line. That conservative rule reduces accidental body splits but cannot identify every historical MBOX variant.

Raw EML exports remove only the envelope separator. They preserve the selected message range and do not guess whether >From body lines should be unescaped. Test exported messages in the target mail application before relying on a migration.

How MIME evidence is interpreted

RFC 5322 defines a message as header fields followed by an optional body and describes header folding. RFC 2045 defines Base64 and quoted-printable transfer encodings, while RFC 2046 defines multipart boundary structure. The auditor applies bounded structural checks from those sources; it does not execute HTML, open links, scan attachment content for malware, authenticate DKIM/ARC/SPF, resolve addresses, or render message bodies.