What Is an EMLX File? The Apple Mail Message Format, and How to Open and Fix One

7 How Do You Open EMLX Files? Mac, Windows and Python

FileInfo's program list lists Apple Mail and a text editor for the Mac, and viewers and converters for Windows and Android. We tested on Linux, so the table marks what we tested and what we did not. Reading an EMLX file and repairing one are different jobs, and the next sections cover both.

Open EMLX files on a Mac

Apple Mail opens EMLX files that it made. To move mail to another Mac, Apple's Mail guide says to export mailboxes and import them again. Those steps use .mbox packages and not loose EMLX files, and the page does not mention EMLX at all.

We did not test Apple Mail with any of our EMLX files, so we cannot say how it treats a damaged one. Copy a file before you open it.

Open EMLX files on Windows

Without Apple Mail you need a viewer or a conversion. Two vendors list Windows viewers for EMLX files on their pages. The cards show what every page says, and we tested neither program.

SysTools says its viewer loads EMLX files from a folder, searches them and shows Hex, MIME, header and HTML views. It says the free version reads EMLX files and that saving attachments needs the Pro version.

Freeviewer says its viewer shows messages with attachments, opens damaged EMLX files and previews in the free version. Its page names a 250 MB limit in one place and no limit in its FAQ, so check your file size first.

Open EMLX files with Python

Install the emlx library with pip install emlx. It reads the count, message and plist. It decodes flags into names. The script prints the subject, flags and text of an EMLX file we made.

import emlx

m = emlx.read('g08_noid.emlx')
print(m.headers['Subject'])
print(m.flags)
print(repr(m.text))

Short note
{'read': True}
'Short body.\n'

The library refuses an EMLX file with a wrong count, as the study shows. If it raises an error, check line 1 and fix the count with our repair script.

8 How Do You Check an EMLX File? Read the count, find the plist, then the message

The script uses only Python's own modules. On a good EMLX file it prints one line. The listing shows the command and result for the 621 byte file from the structure section.

python3 check_emlx.py g01_plain.emlx
result: ok

The figure follows the order of the checks. The first two are about the count line. The third compares the count with the actual plist position, and the fourth reads the plist. The damage test lists ten causes behind the numbers.

Check EMLX files with Python

The script allows spaces before the count and a CR LF after it, because both read fine in our tests. It fails on a byte order mark, a blank first line, a count of 0 and a count past the end. Then it looks for the plist, parses it and reads the message headers.

"""Check the structure of an EMLX file. Reads only. Usage: python3 check_emlx.py file.emlx"""
import email, plistlib, re, sys
from email import policy


def check(data):
    out = []
    def bad(level, text): out.append((level, text))
    if data[:3] == b'\xef\xbb\xbf':
        bad('warn', 'file starts with a byte order mark')
    m = re.match(rb'[ \t]*(\d+)[ \t]*\r?\n', data)
    if not m:
        bad('fail', 'first line is not a byte count')
        return out
    n, start = int(m.group(1)), m.end()
    if n == 0:
        bad('fail', 'byte count is 0')
        return out
    if start + n > len(data):
        bad('fail', 'byte count %d goes past the end of the file (%d bytes after the first line)' % (n, len(data) - start))
        return out
    if m.group(0).endswith(b'\r\n'):
        bad('warn', 'first line ends in CR LF')
    rest = data[start + n:]
    if not rest.startswith(b'<?xml'):
        found = re.search(rb'<\?xml[^>]*\?>\s*<!DOCTYPE plist', data[start:])
        if found:
            bad('fail', 'no plist at byte %d. The plist starts at byte %d, so the count is %d %s' % (n, found.start(), abs(found.start() - n), 'too small' if found.start() > n else 'too big'))
        else:
            bad('fail', 'no plist after the message')
        return out
    try:
        pl = plistlib.loads(rest)
        if not isinstance(pl.get('flags', 0), int):
            bad('warn', 'flags is not a number')
    except Exception as e:
        bad('warn', 'plist does not parse (%s)' % type(e).__name__)
        pl = None
    tail = rest[rest.rfind(b'</plist>') + 8:] if b'</plist>' in rest else b''
    if tail.strip():
        bad('warn', '%d bytes follow the plist' % len(tail))
    msg = email.message_from_bytes(data[start:start + n], policy=policy.default)
    if not any(msg[h] for h in ('from', 'date', 'subject')):
        bad('warn', 'message has none of From, Date or Subject')
    for d in msg.defects:
        bad('warn', 'message defect: ' + type(d).__name__)
    for part in msg.walk():
        for d in part.defects:
            bad('warn', 'message defect: ' + type(d).__name__)
    return out


if __name__ == '__main__':
    res = check(open(sys.argv[1], 'rb').read())
    for level, text in res:
        print(level.upper(), text)
    print('result:', 'fail' if any(l == 'fail' for l, _ in res) else 'warn' if res else 'ok')
    sys.exit(2 if any(l == 'fail' for l, _ in res) else 1 if res else 0)

Here is what it printed for four damaged EMLX files. The first has a count that is 1 too small. The second is cut in half. The third has a plist cut in half, and the fourth has a CR LF after the count.

python3 check_emlx.py c01.emlx
FAIL no plist at byte 4677. The plist starts at byte 4678, so the count is 1 too small
result: fail

python3 check_emlx.py c25.emlx
FAIL byte count 4678 goes past the end of the file (2483 bytes after the first line)
result: fail

python3 check_emlx.py c19.emlx
WARN plist does not parse (ExpatError)
result: warn

python3 check_emlx.py c11.emlx
WARN first line ends in CR LF
result: warn

The first listing names the actual plist start. That is the number a repair needs. The second shows an EMLX file that lost half of its message, and no repair brings that back. The last two draw only warnings, because the message is complete.

What the script found in 27 damaged EMLX files

The script checks structure and does not scan for malware. It cannot show if an email is genuine. It follows the stricter reader on one point, because it fails an EMLX file with a blank line before the count, which Thunderbird logic reads.

Check an EMLX file by eye

You can do the main check in a terminal. Read line 1, then ask grep for the plist byte position. That position minus the length of line 1 and its line break must equal the count. The listing shows the result for the 621 byte file.

head -n 1 g01_plain.emlx
323
grep -b -o -a '<?xml' g01_plain.emlx
327:<?xml

Line 1 has 3 digits and a line break, which is 4 bytes. The plist starts at byte 327. Then 327 minus 4 is 323, which is the count. We tested this on Linux with GNU grep and did not try it on a Mac.

9 Are EMLX Files Safe to Open? Reading is safe, and the email inside is an email

The ending says nothing about safety. EMLX files are stored emails, and their safety depends on who wrote them. The table lists what to check, and every row ends with its source.

Why a reader is safer than a viewer

A reader prints what it finds. A viewer builds the email on screen, with its formatting and its images. We checked 39 EMLX files before and after every reader and script. The SHA256 hash of every file was the same.

Use a reader first when you are not sure what a file is. Read the headers as text. Look at the sender and subject. Then decide. Keep the original untouched.

Why you should read the first line

A file that ends in .emlx can be anything. A good EMLX file begins with digits and a line break, and then message headers like From or Subject. Our script checks line 1, and a text editor shows it too.

11 How Do You Convert an EMLX File? EML, MBOX and a repair for the count

Two kinds of work belong here. One copies the message out of an EMLX file. The other repairs line 1 so that a reader accepts the file. Choose by what you need next. The table lists what we found.

Convert EMLX files to EML

The message part of an EMLX file is already an EML file. The script reads line 1 and returns that many bytes. The listing shows the script in full. It reads the files you name and writes new ones, and it never changes an EMLX file.

"""Convert EMLX to EML, EMLX to MBOX, and repair a wrong byte count. Reads only the file you name."""
import mailbox, os, re, sys

PLIST = re.compile(rb'<\?xml[^>]*\?>\s*<!DOCTYPE plist')


def to_eml(data):
    nl = data.index(b'\n')
    n = int(data[:nl].strip())
    return data[nl + 1:nl + 1 + n]


def repair(data):
    """Rebuild the first line from where the plist really starts."""
    data = data.lstrip(b'\xef\xbb\xbf \t\r\n')
    m = PLIST.search(data)
    if not m:
        raise ValueError('no plist found, cannot repair')
    nl = data.find(b'\n')
    first = data[:nl] if nl >= 0 else data
    start = nl + 1 if (nl >= 0 and b':' not in first and nl < m.start()) else 0
    return b'%d\n' % (m.start() - start) + data[start:]


def to_mbox(paths, out):
    box = mailbox.mbox(out)
    box.lock()
    for p in paths:
        box.add(mailbox.mboxMessage(to_eml(open(p, 'rb').read())))
    box.flush(); box.unlock(); box.close()


if __name__ == '__main__':
    for p in sys.argv[1:]:
        open(os.path.splitext(p)[0] + '.eml', 'wb').write(to_eml(open(p, 'rb').read()))

Use to_eml for one EMLX file, to_mbox for many EMLX files and repair when the count is wrong. From a terminal, python3 convert_emlx.py a.emlx writes a.eml next to the original.

Fix a wrong count

A repair rebuilds line 1 from the place where the plist starts. On 27 damaged EMLX files it gave a readable file with the right message and flags for 19. Five had no plist to find, and 3 had a damaged plist that the library still refused.

The message itself came out right for 22 damaged EMLX files after a repair. A direct cut by the count added two more, the ones without a plist. Only the 3 cut files lost the message. A repair cannot bring back text that is not in the file.

Convert EMLX files to MBOX

Python's mailbox module writes the mbox. The listing converts two EMLX files to one mailbox. Our test of 12 EMLX files gave 12 messages, and the mbox opened with the same module. Apple's Mail page lists the mbox format as the way to import mail from Windows or UNIX computers.

from convert_emlx import to_mbox

to_mbox(['a.emlx', 'b.emlx'], 'mail.mbox')

Keep the flags

Neither conversion keeps the plist. Read the flags first with the flags script and write them down. Thunderbird import code copies four of them, which are read, answered, flagged and forwarded, into its own status header.