Before anything else: this is a workflow, not a certification
This guide describes a practical process for producing email evidence using consumer-grade Mac tools. It is not a substitute for advice from counsel, nor is it a certified forensic workflow. For high-stakes matters, engage a qualified eDiscovery vendor or forensic examiner. For routine internal productions, document retention, or small-matter evidence collection where budget won't support a dedicated platform, the workflow below is practical and defensible when paired with careful documentation.
The end-to-end process
- Scope. Define what to collect.
- Collect. Export MBOX archives from each source system.
- Preserve. Copy originals, hash them, work only on copies.
- Filter. Select only in-scope messages.
- Produce. Convert to PDF with consistent formatting and stamps.
- Verify. Spot-check and document.
Step 1 — Define scope
Scope creep is the enemy of a defensible production. Write down, before touching any email, the four dimensions of your collection:
- Custodians. Whose mailboxes are being collected? Full names and email addresses.
- Date range. Explicit start and end dates. Include a couple of weeks on either side if the scope is fuzzy — pruning later is easier than re-collecting.
- Keywords or subject-matter criteria. What makes a message responsive? Document the search terms, or the topic definition if keyword matching isn't appropriate.
- Inclusions / exclusions. Sent + received + drafts? Auto-archived? Spam? Specific folders?
Keep this scope document as part of the production log. When opposing counsel asks how you determined what was responsive, this is the answer.
Step 2 — Collect MBOX exports
For each custodian and each mail source, produce an MBOX export. The process depends on the source:
- Gmail / Google Workspace: Google Takeout. Select only Mail, MBOX format. For scoped exports, label the messages in Gmail first and Takeout just that label. See the Gmail Takeout guide.
- Apple Mail: Select mailbox → Mailbox → Export Mailbox. See the Apple Mail guide.
- Thunderbird: The MBOX files live in the profile folder. Copy them out. See the Thunderbird guide.
- Microsoft 365 / Exchange: Export via Outlook on Windows (PST), then convert PST → MBOX with Aid4Mail or similar before this workflow. For Mac-only environments, use the web interface's Takeout equivalent if available, or have IT produce server-side exports.
- Corporate servers (Dovecot / Postfix): IT can produce MBOX files directly from the server. Request by mailbox name and date range.
Step 3 — Preserve originals
This step is what turns a casual export into a defensible one. Do it every time.
- Create a dedicated "Originals" folder. On an external drive or a dedicated project directory. Write-protected if possible.
- Copy each MBOX into Originals with a consistent naming convention. Example:
SMITH_Alice_Gmail_2024-01-01_to_2024-12-31.mbox. - Calculate SHA-256 hashes for every file. In Terminal:
Keepshasum -a 256 *.mbox > hashes.txthashes.txtin the Originals folder. You can re-verify at any point that the files haven't been modified. - Work from a copy, not the original. Duplicate the Originals folder to a Working folder. All filtering, conversion, and review happens on Working copies.
MBOX to PDF reads input files but never modifies them. Output goes to a separate folder you specify. Still, the copy-and-hash habit protects against accidents and satisfies most reasonable chain-of-custody questions.
Step 4 — Filter to in-scope messages
Open MBOX to PDF and drag the Working copies in. The selection view shows every message with sender, recipient, subject, and date.
Apply your scope filters:
- Date range: Sort by date. Select the range you need; deselect the rest.
- Sender / recipient: Sort by sender. Select or exclude specific parties.
- Subject keywords: Eyeball the list, or use the app's built-in search where available.
For complex keyword-based responsiveness review across many custodians, this manual filtering hits a ceiling. Engage a review platform (Relativity, Logikcull, Disco, etc.) when your collection exceeds what one person can review manually. MBOX to PDF is useful for small-to-medium productions and for generating PDF sets feeding a downstream platform.
Step 5 — Produce with consistent formatting
Configure MBOX to PDF's output for production work:
Recommended production settings
- Output mode: Combined PDF. One document with continuous pagination is easier to reference ("see page 47") than hundreds of individual files.
- Page size: Letter (US legal standard) or A4 (UK/EU).
- Margins: 1 inch / 2.5 cm minimum. Leaves room for Bates stamps added later if needed.
- Page numbers: Footer, centered or bottom-right. Sequential across the full production.
- Header: Matter name and date. E.g. "Smith v. Jones — Produced 2026-04-22".
- Watermark: "Confidential" or "Attorney Work Product" depending on the production type.
- Font: A monospaced or plain sans-serif. Consistency matters more than style.
- Quoted replies: Leave them in. Thread context is often material in legal review.
- Attachments: Extract to sibling folder, not embedded. Easier to search and review separately.
- Metadata: Show all header fields (From, To, CC, BCC, Subject, Date). Do not strip.
A note on Bates numbering
Formal Bates numbering — party prefixes with consecutive numbers like SMITH_000001 through SMITH_041572 — is typically applied in a dedicated review or production platform (Relativity, CaseFleet, Logikcull, etc.) after PDF conversion. MBOX to PDF produces consistent sequential page numbers across the PDF set; convert those to formal Bates stamps in your review tool.
For small productions where you don't have a platform, PDF editors like Adobe Acrobat or PDF Expert can apply Bates numbering to an existing PDF in a separate pass.
Step 6 — Verify and document
Before you produce anything, verify the output and build your production log.
Verification checklist
- Total page count recorded and matches the document index.
- First page and last page of each logical section legible.
- Headers, footers, and watermarks applied uniformly throughout.
- Attachments extracted and named to match source emails.
- Sender, recipient, date, subject visible for every message.
- No OCR or rendering failures on HTML-heavy emails (spot-check 5–10%).
Production log entries
For every production, record:
- Matter name and production number
- Date of collection
- Custodians and date ranges
- Source systems (Gmail, Apple Mail, etc.) with software versions
- SHA-256 hashes of source MBOX files
- Conversion tool + version (e.g. "MBOX to PDF 1.1.0")
- Conversion settings (page size, margins, stamps used)
- Output page count and hash of the final PDF
- Who performed the conversion and when
Keep this alongside the Originals folder indefinitely. It's the authentication document if the production is ever challenged.
Handling privileged material
Privilege review is separate from collection and production. The recommended pattern:
- Collect the full responsive set with MBOX to PDF.
- Hand the PDF set to reviewing attorneys (or upload to a review platform).
- Reviewing attorneys mark privileged documents.
- Remove privileged documents from the final production.
- List removed documents on a privilege log (author, recipient, date, subject, privilege claimed).
- Produce the redacted set + the privilege log to opposing counsel.
MBOX to PDF does not perform automatic privilege detection. All privilege review is manual or via a dedicated review platform.
When to escalate beyond Mac tools
The MBOX-to-PDF-on-Mac workflow is appropriate for:
- Small productions (hundreds to low thousands of emails)
- Single-custodian or small-custodian collections
- Internal investigations
- Document retention conversions
- Small-matter litigation
Escalate to a dedicated eDiscovery vendor or platform when you hit:
- High six-figure document counts or multi-terabyte collections
- Cross-platform native collections including cloud drives, chat, and mobile
- Complex keyword or concept-based responsiveness review
- Matters with aggressive opposing counsel or court-ordered protocols
- Regulatory investigations (SEC, DOJ, etc.) where tool chain-of-custody standards are higher
Even with a full eDiscovery platform, MBOX to PDF often plays a role in the intake pipeline — converting raw MBOX from custodian self-collection into standardized PDFs for platform ingestion.
Frequently asked questions
What format should email evidence be produced in?
PDF is the standard production format. It's portable, consistent, and viewable without an email client. Native MBOX or EML is often requested alongside for authentication.
Does MBOX to PDF support Bates numbering?
MBOX to PDF produces consistent sequential page numbers. Formal party-prefixed Bates stamps (e.g. SMITH_000001) are typically applied in a dedicated review platform or PDF editor after conversion.
How do I preserve chain of custody?
Copy originals to a protected folder, SHA-256 hash every file, document every conversion step and tool version, and work only on copies. MBOX to PDF does not modify input files.
Can I filter by date range and custodian?
MBOX to PDF's selection view lets you manually include or exclude messages. For keyword-based responsiveness review across many custodians, use a dedicated review platform downstream.
How do I handle privileged emails?
Privilege review is manual (or via a review platform) after initial conversion. Remove privileged documents from the final production and list them on a privilege log.
Should attachments be produced separately?
Typically yes. MBOX to PDF extracts attachments to a sibling folder for easier review and search.