How to search Mail in Time Machine?

Question

I'm looking for a specific email I may have deleted, but I don't remember when I received it (it was at least a couple months ago). Digging through my Mail history in Time Machine for a single email would take forever - why isn't there an obvious search function for Time Machine?

Does anyone have a technique or strategy for searching past emails in Time Machine?

Answer 1

Emails are stored in sub-directories located in ~/Library/Mail/V2 in .emlx format. This allows you to do a global plaintext search within a specific time machine backup folder.

I wrote a shell script to search for text within all .emlx files in a specific time machine backup.

Alternatively you can do a drive search in terminal (what my script automates). Replace Search Query with what you want to search for:

find "/Volumes/Time Machine" -name "*.emlx" -exec grep -l "Search Query" {} \;

Or also replace /Volumes/Time Machine with a more specific directory to speed things up e.g /Volumes/Time Machine/Backups.backupdb/stan/2014-09-16-084603/

Answer 2

The recommended way to search through Time Machine is using Spotlight.

From Apple Support - Recover items using Time Machine and Spotlight:

1. Open a Finder window and type a search word or phrase in the search field in the upper-right corner.

2. Select a location to search in the location bar. You can search your entire computer (This Mac) or the folder that was selected in the Finder when you started your search. New search results begin to appear after you select a location.

3. Refine the results by specifying search criteria.
   Narrow down Spotlight search results
4. Click the Time Machine icon in the Dock. If the Time Machine icon isn’t in the Dock, look for Time Machine in the Applications folder.
5. Use the arrows and the timeline along the right edge of your screen to browse through the Time Machine backups. Your search is performed in every window.
6. When you find the item you want to restore, select it, and then click Restore.

As another alternative, you can also use the free EasyFind application from Devon Technologies on your Time Machine drive.

Answer 3

The trick is to do a Spotlight search in the Finder, but with the starting point already in the Time Machine.

1. Open a Finder window and navigate in the Time Machine all the way in the computer's folder, so that the Finder window displays the list of snapshots.
2. Enter the search query in the Finder search box.
3. Click the + on the right side to add a search parameter: Kind is Other. A box will appear for entering the value; enter mail here.
4. Click the + again to enter another search parameters: System files are included.

The Finder will consult the Spotlight database for the Time Machine, and display all of the matching mail messages, across all of the snapshots.

You can use QuickLook (the spacebar) to view any message.

The path bar at the bottom of the window shows the (long) path leading to the mail message. About halfway down the path, and one of the few folders with an recognizable name, is the .mbox folder that contains the message. The name of this folder corresponds to which Mail folder contains the selected message.