XT_ExtractDocsMail v1.0.0

First public release of XT_ExtractDocsMail, an X-Tension for X-Ways Forensics (x64)
that automatically exports the files of a forensic image organized by category,
rebuilding each file's original path — all from a single command line.

What's included

• XT_ExtractDocsMail.dll — 64-bit X-Tension, ready to use.
• Full source and build instructions are in the repository.

Requirements

• X-Ways Forensics x64 (tested on the 21.x series; category retrieval requires v18.9+).
• Windows.

Quick start

set "XT_OUT=Y:\Export" && "C:\xwf21.7\xwforensics64.exe" "NewCase:W:\xways" "AddImage:Y:\Images*.E01" RVS:~ "XT:C:\xwf21.7\XTension\XT_ExtractDocsMail.dll" auto

Output layout: <Root>\<Evidence>\<Category>\<original file path>

Important

The tool exports only files that X-Ways has already assigned a category to. Categories are
populated by file type verification during Refine Volume Snapshot — that is why RVS:~
runs before XT: in the command above. Without type verification, nothing is exported.

Verify the download

SHA-256 of XT_ExtractDocsMail.dll: 3d97f0877c55168652df5c9bcc401045855f20c1cefc6dd0461cd69393a80d09
On Windows: certutil -hashfile XT_ExtractDocsMail.dll SHA256

License

Apache License 2.0. Built on the X-Tension API of hmrc/XT_XWF-AutoCTR (Ted Smith / HMRC).
See LICENSE and NOTICE.