Incredimail IMM and IML

From ForensicsWiki
Jump to: navigation, search

IMM

The Incredimail email file (IMM) is used by the Incredimail email client to store all the email data. The .imm files are basically meant for storing the emails. They do not have the caliber to keep hold of attachments. The Incredimail email client is an advanced application that has a benchmarked level of graphically enabled features and attributes. It was developed by Perion Network Ltd.

Location of IMM

On Windows XP, the default location where the IMM is stored by Incredimail can be obtained by clicking on “Tools” and selecting “Options” from the dropdown menu. Now move to “General” tab, followed by “Data Folder Settings”. Now in the Data Folder Settings pop – up window, copy the displayed path and paste it in the address bar of windows explorer. Move to “Identities” > “String of Numbers” > “Message Store Folder”. You can now view the available IMM files (inbox.imm. deleted items.imm, outbox.imm, etc.).

On Windows 7, to view the stored IMM files, move to the following location: - “C:\Users\%username%\Appdata\Local\IM\Identities”

Under the “Identities” folder, locate the "Message Store"; in which under the “Messages” folder, you can locate the “msg.iml” file. The users of Incredimail 2.0 and previous versions can find the file as “msg.imm”, where as the latter one’s can now recognize it as “msg.iml”.

The header meta data of the IMM files gets stored in a peculiar format that is recognized as an IMH file extension.

Structure of IMM

The structure of IMM file is very much similar to that of MBOX files that keeps hold of multiple emails. The file, when viewed with a text editor like notepad; shows that it starts with the simple structure of Delivered-To and Received meta data fields. Each and every information related to all the emails such as Return-Path, DKIM-Signature and many more can be viewed easily.

External Links

Tools

Incredimail Converter