How to save attachments from MBOX emails safely

Often the reason for opening an old archive is a file: a signed contract, a set of photos, a spreadsheet someone sent years ago. MBOX files keep attachments inside the messages, so you need a tool that can decode them back into normal files.

How attachments are stored in MBox Viewer archives

Every attachment is part of the email's MIME structure. The file is converted to Base64 text and placed between boundary lines, with headers that give its name and type, for example:

Content-Disposition: attachment; filename="contract.pdf"

Images embedded in the body of HTML emails, such as logos and signatures, are stored the same way but marked as inline. They are usually referenced by a Content-ID so the email can display them in place.

Saving files one at a time with MBox Viewer

1. Open the MBOX file in MBox Viewer with File → Select folder… and click the archive.
2. Search for the sender, subject or attachment name if you know it.
3. Click the message. Its attachments are listed with it, and pictures can be previewed.
4. Open the attachment or save it to a folder of your choice.

Outlook's packed winmail.dat attachments can be opened with a double-click to show the files inside.

Saving many attachments at once with MBox Viewer

MBox Viewer can export the attachments of all mails in an archive in one pass, which is the simplest option on Windows. Two other free routes also work well:

• Thunderbird with ImportExportTools NG. Import the MBOX file, select the messages and use the add-on's option to save all attachments to a folder.
• A short Python script. Python's built-in mailbox module can walk through every message and write each attachment to disk. It is a good choice for archives of tens of thousands of messages.

A minimal script looks like this:

import mailbox, os
for i, msg in enumerate(mailbox.mbox("archive.mbox")):
  for part in msg.walk():
    name = part.get_filename()
    if name:
      open(f"out/{i}-{os.path.basename(name)}", "wb").write(part.get_payload(decode=True) or b"")

Create the out folder first. The message number at the start of each name prevents files with the same name from overwriting each other.

Safety checks before opening MBox Viewer attachments

Old archives can contain old threats. Spam and phishing messages from years ago may still carry harmful attachments.

• Be careful with .exe, .scr, .js, .vbs, .bat and .iso files, and with Office documents that ask you to enable macros.
• Scan saved files with your antivirus before opening them.
• Check the sender of the message before trusting a file, especially in the Spam folder of a Gmail export.

Saving a file does not run it. The risk only starts when you open it, so you can safely save first and check afterwards.

When an attachment seems missing in MBox Viewer

• The sender may have shared a link to a cloud file rather than attaching it. The link may no longer work.
• Very large files are sometimes removed by mail servers and replaced with a short notice.
• Thunderbird IMAP folders may hold only headers if offline storage was off. See the Thunderbird article in this guide.