EML vs PST vs MSG vs MBOX: Email File Formats Explained

If you've received an email archive and can't figure out how to open it, the format is usually why. PST, EML, MSG, and MBOX are four different ways to package email data, and they don't work interchangeably. Each comes from a different source, stores different things, and requires different tools to open or convert. This guide explains what each format actually is, where you're likely to encounter it, and what to do with it when you do.

Quick Comparison: The Four Main Email File Types

What Each Format Is

PST: The Outlook Mailbox Container

PST stands for Personal Storage Table. It's Microsoft's proprietary format for archiving entire mailboxes, including folders, messages, contacts, calendar events, and attachments, in a single file. Outlook creates a PST when you export a mailbox, and it's the standard output format from Microsoft 365 Content Search and the Compliance Center export tools.

A PST can be enormous. Exporting a large mailbox produces a file measured in gigabytes. It can only be opened natively in Microsoft Outlook on Windows, though third-party tools exist for other platforms. If you're dealing with a PST file without Outlook, you'll need one of those tools or a dedicated PST reader.

There's also OST (Offline Storage Table), a closely related format. OST files are Outlook's local cache of an Exchange or Microsoft 365 mailbox and are not intended for sharing or archiving. Unlike PSTs, OST files are tied to the account they were created for and generally can't be opened on a different machine without conversion. You'll encounter OST files when collecting email data from a user's computer rather than the server.

EML: The Universal Single-Email Format

An EML file is a single email message stored in plain text following the RFC 5322 standard, the same format emails travel in over the wire. Because EML is an open standard, it's supported by virtually every email client: Outlook, Thunderbird, Apple Mail, and many others. When you drag a message out of Thunderbird or save an email to disk in most clients, you get an EML file.

EML files contain the full message header (from, to, date, subject, routing information), body (plain text or HTML), and any base64-encoded attachments, all in a single file. They're human-readable in a text editor, which makes them useful for forensic inspection. They're also the most portable email file type: if you need to hand a single email to someone who doesn't share your email system, EML travels well.

One common task is converting EML files to PDF for review or production. Most review tools and eDiscovery platforms handle this as part of standard processing.

MSG: Outlook's Single-Message Container

MSG is Microsoft's proprietary format for saving a single email message from Outlook. Unlike EML, which is plain text, MSG is a binary format based on Microsoft's Compound Document File Structure, the same underlying format as older Word and Excel files. This means MSG files preserve more Outlook-specific data than EML, including custom properties, meeting requests, and voting response data, but they're less portable as a result.

The most common source of MSG files is someone right-clicking a message in Outlook and choosing "Save As." You'll also see them produced by tools that export email from Outlook desktop or Exchange one message at a time. Opening an MSG file natively requires Outlook on Windows. If you receive an MSG file and need to open it without Outlook, you'll need a dedicated viewer or conversion tool.

The practical difference between EML and MSG comes down to source system and portability. EML is produced by non-Outlook clients and open standards; MSG is produced by Outlook and carries Outlook-specific data. If you need to work with MSG files across platforms, converting to EML is often the cleaner path.

MBOX: The Unix and Google Takeout Format

MBOX is an old format, dating to Unix mail systems in the 1970s, but it's still the most common output for Gmail, Apple Mail, and Thunderbird exports. In an MBOX file, all messages are concatenated into a single plain-text file, separated by a line beginning with "From " followed by the sender address and timestamp. The entire mailbox or folder is one file, which can run to gigabytes for large accounts.

When you use Google Takeout to export Gmail, you get an MBOX file. When Apple Mail or Thunderbird exports a mailbox, it produces MBOX. This format's universality on non-Microsoft platforms makes it the common denominator when migrating away from Gmail or handling email data from Mac-based users.

MBOX's weakness is size and structure: opening a multi-gigabyte file to find a single message requires either an email client that supports MBOX natively (Thunderbird, Apple Mail) or a dedicated MBOX viewer. Converting MBOX to PST is a frequent task for people migrating from Gmail to Outlook or importing data into an Exchange-based eDiscovery workflow.

EMLX and OST: The Variants Worth Knowing

EMLX is Apple Mail's variation on the MBOX concept. Instead of concatenating all messages into one large file, Apple Mail stores each message as its own .emlx file inside a directory structure. This makes individual message access easier but means a mailbox export produces thousands of small files rather than one large one. If you receive a folder full of .emlx files, they came from Apple Mail on macOS.

OST files deserve a brief mention because they appear occasionally in eDiscovery collections. An OST is Outlook's local offline cache of an Exchange or Microsoft 365 mailbox. They aren't an export format as such, but when IT collects from a user's laptop rather than the server, they may encounter an OST. Converting an OST requires specialized tools, and the resulting data should be verified against a server-side export to confirm completeness.

Where You'll Encounter Each Format

In eDiscovery and compliance work, the format you receive reflects where the data came from and how it was exported. That context matters.

Microsoft 365 Content Search and Compliance Center produce PST by default. When a legal or IT team exports a Microsoft 365 mailbox for litigation or investigation, they get one or more PST files. This is a whole-mailbox export by default, which means a PST often contains everything in the account for the relevant date range, relevant and irrelevant alike.

Google Workspace and Gmail Takeout produce MBOX. Google Vault, which is the eDiscovery tool for Google Workspace, can export in either MBOX or PST format depending on configuration. Google Takeout, the self-serve export available to individual users, always produces MBOX files. The distinction between a Vault export (admin-controlled, auditable) and a Takeout export (user-controlled) matters in a defensibility context.

Individual Outlook saves produce MSG files when a custodian is saving individual messages, or PST files when exporting a folder or mailbox. This comes up when an employee is asked to collect their own responsive emails, which carries its own defensibility concerns around completeness and selection criteria.

Non-Outlook clients and cross-platform exports most often produce EML. Thunderbird, Apple Mail, and web-based clients that support message export typically use EML. It's also the common output from older enterprise archiving platforms and many third-party export tools.

Converting Between Formats

Conversion between email formats is often necessary when the producing party's system doesn't match the receiving party's tools, or when a review platform requires a specific input format. Here are the paths that come up most often and why:

• MBOX to PST. A Gmail user migrating to Outlook, or a legal team that received a Google Vault export and needs to load it into a PST-based review workflow. Most email migration tools handle this.
• MSG to EML. Converting individual Outlook messages to a more portable format for review in a non-Outlook environment or when handing off to a cross-platform eDiscovery tool.
• EML to PDF. The most frequent conversion request in legal contexts. Courts and opposing counsel often request PDF with Bates numbering rather than native email formats for production.
• PST to EML. Extracting individual messages from a large PST archive for selective review or flat-file production. Useful when only a subset of messages from a mailbox are responsive.
• MBOX to EML. Splitting an MBOX file into individual EML files for platforms or reviewers that handle single-message files better than concatenated archives.

Dedicated conversion tools exist for each of these paths. For bulk conversions in an eDiscovery context, most processing platforms handle the conversion during ingestion so the reviewer sees rendered messages regardless of the source format.

Which Tools Open Which Formats

For most one-off viewing tasks, Thunderbird is worth installing even if you don't use it as a daily email client. It opens EML, MBOX, and (with an add-on) MSG files, and it's free and cross-platform. For PST, the easiest path on Windows without Outlook is one of the several free PST viewers available; on Mac or Linux, libpst can convert PST to MBOX for import into Thunderbird.

For eDiscovery specifically, all four formats are handled by major review platforms. Relativity, Everlaw, and Logikcull ingest PST, EML, MSG, and MBOX and convert them during processing. The platform handles the format; the reviewer sees rendered messages.

What the Format Tells You About the Production

The format of a production isn't just a technical detail. It reflects decisions made during the export process, and in discovery those decisions can matter.

A PST production almost always means a whole-mailbox export. The producing party ran an account-level export and you're receiving everything in that mailbox for the relevant date range. This is efficient but often means a large volume of irrelevant material alongside the responsive messages. If you receive a PST, your first questions should be: which account does this cover, what date range was applied, and what, if anything, was culled before export.

A collection of individual EML or MSG files suggests a different process: selective saves, likely by the custodian or an IT administrator picking messages by hand or by search query. This raises questions about what the selection criteria were and whether the production is complete. It doesn't mean the production is deficient, but understanding how the files were collected is worth asking about in a discovery conference or deficiency letter.

An MBOX production almost always comes from a non-Microsoft environment, usually Gmail or Apple Mail. If you're handling a matter involving a Google Workspace company, expect MBOX and plan your review workflow accordingly. The distinction between a Google Vault export (admin-controlled, auditable) and a Takeout export (user-initiated, no admin oversight) is worth surfacing if you're uncertain which one you have.

In short: the format is your first clue about how the data got to you. PST suggests a full mailbox pull from a Microsoft system. Individual MSG files suggest selective Outlook saves. MBOX suggests a non-Microsoft source or Google Takeout. EML is the most ambiguous and can come from many places. Reading the format tells you something about the producing party's workflow, and sometimes about gaps you may want to investigate further.