Learn In-Depth Anatomy of Pegasus Mail

Alexa JacksonDigital Forensic Analyst
Published:
Updated:
Pegasus Mail is a donation ware that is a collaboration of David Harris along with his team members. It is a desktop mail client that offers the option of configuring more than one mail account with single set up. It supports POP3, IMAP, and SMTP protocols for sending and receiving the emails. The best part about this application is it does not make any changes to the Windows registry and thus it is considered as a portable application for the USB drives. 

pegasus-mail.pngEvery new mail that arrives in the “New Mail” folder of Pegasus gets saved into CNM file. For every message, this text file with .cnm extension is created under “C:\Program File\PMAIL\Admin”. The CNM filename is unique and thus it is considered as the message ID. 

CNM-file.pngThe normal messages (local or by Mercury Mail Transport Server) gets saved with initial letter Y but if the profile is having pop3 access of an account, the message will be saved with initial letter P. 

file-location.pngThe data of other system defined folders gets saved into .PMM files along with their indexes in .PMI file format. For example: copyself.pmi, main.pmi etc. 

PMM-files.pngExporting Emails into Text Data Files

The messages in Pegasus Mail account can be saved on disk into a text file. Either all mails from the folder or single mail in the folder can be exported into MBOX file. For this, select the messages, right click on it, and choose “Save Messages to Disk…” 

messages-folder.pngDefine if you want to save all messages into MBOX file or for every mail, an individual MBOX file to be created. Give a name to the file and click “Open”. Your messages will be saved on disk at desired location. 

extract-message.pngmail-folder.pngCheck Out CNM File Corresponding to Email

File located in New-Mail Directory (CNM file),  is saved with a unique name and it is not possible to determine which message it holds because the application names it through GUID. So, to know CNM file unique name for any mail, select it, right click on it, go to “Message Properties”. 

message-properties.pngIn the textbox for “Filename”, you can find out the CNM name for the mail. 

Filename.pngMove Mails to Sub-Folder:

Until now, we discussed the default message saving systems and location. Now, if a customized (or user defined) subfolder is created under any folder, then there is option to save it in MBX file format (which is a variant of MBOX file). To create a new folder, click on the “Add” button. 

add.pngGive a name to the new folder under “Name and type for new folder” text box and select the folder type as “Unix Mailbox Format”. 

enter-name.pngNow select the mails that you wish to move to the sub-folder and in the menu bar, click on “Move” button. 

move-folder.pngSelect the Folder and click on “Open” button. 

open-folder.pngThe MBX file would be saved with UNX (Unix) with a string. 

UNX.pngConfiguration File:

The configuration details of Pegasus gets saved into an ID file which is also a form of text file. It is located at “C:\PMAIL\MAIL\Admin” and can be simply opened in Notepad. 

PMAIL.pngnotepad.pngMessage Header:

The internet header of every message in Pegasus stores its routing information. To check that out, select the message, right click on it, and choose “Message Headers”. A pop up will get opened where entire email information will be saved. 


header.pngRule Filtering For Emails Management

On regular basis, a lot of emails get collected in the mailbox and thus managing them becomes a troublesome job. But fortunately, PMail have message filtering options offered that allows the users to download mails into separate folders and customize it accordingly. Here is how the rules for downloading emails into the mailbox can be set.

To set rules for emails, go to Tools. Drop down to Mail Filtering Rules>>Edit new mail filtering rules>>Rules applied when folder is opened…

tools-menu.pngA window named New mail filtering rules will get opened. Select Add rule

rule.pngMultiple rules can be set by the users for the emails and for managing their availability in different folders. Click on the relevant option and add a rule in relevance to the requirement. 

headers.pngHeader:
Here, the application will check out the header of email. Use the check boxes to instruct the application what it has to check in the header and take relevant action. 

move-option.pngOn the Settings button, you have the option to define the folder where the mail should be moved or copied. 

set.pngExpression: 

email-forensics.pngMessage Size:

Relevant action on an email can be taken according to size of the email that is downloaded from the server. 

edit-a-rule.pngMessage Date:

Messages received between a defined time interval can be moved or copied to separate folder. The time range can be provided in terms of days, months, or year gaps. 

click-ok.pngMessage Age:

If a message is older than a certain time period, an action can be defined for it. This helps in archiving or mailbox space manageability. 

select-days.pngMessage Color:

If a message contains a particular color, it can be filtered on this basis. 

colour.pngAttachments:

This will check for certain words in the attachment name, the attached file, or will check out for file extension. And if it is found, the defined action can be taken for the mail. 

rule-based.pngMessage Attributes:

The application will check out for following attributes in the mail and if found the defined action for the message will be processed. 

message-attributes.pngList Membership:

If the message is received from someone in the distribution list, then it can be moved, copied, or selected action for it will be taken. 

list-membership.pngFiltering Against Spam:

The emails downloaded is a mix of regular messages, subscribed mails, social, promotional, or spam. Amongst the various mails, it is hard for an application to examine which one is the spam message and could lead the user into trouble. Pegasus includes Spam and Content Control system that can help to remove suspicious mails from the list. Here are the options that can be customized accordingly.

In the Tools menu, move down to Spam and Content Controls and choose Global Whitelist

pegasus-mail.pngHere, you can add the list of whitelist address. Also, there is option of adding recipients to the whitelist if an email is sent to them through the account. 

whitelisted-addresses.pngSpamhalter is basically a Bayesian filter that checks out the behavior of emails through links, contents, domains etc. It analyzes the emails and find something unexpected is found, the mail might be considered as spam and will be moved according to the action defined in the rule. To instruct the application to do this, enable the Spamhalter. 

spamhalter-configuration.pngAnother spam filter settings is for the content. There are options provided that can be chosen accordingly to make it easy for the application to check out the content and act accordingly if a spam is received. 

editing-content.pngPegasus offers an efficient emailing experience to the users and with excellent phishing protection and spam filtering through built-in Bayesian technique, it ensures that a secure shield for emails is provided to the users. Also, the way data is stored in Pegasus and can be brought to disk proves quite helpful in forensic analysis of email database.  
5
2,819 Views
Alexa JacksonDigital Forensic Analyst

Comments (5)

Jim HornSQL Server Data Dude
CERTIFIED EXPERT
Most Valuable Expert 2013
Author of the Year 2015

Commented:
Great read, and an outstanding use of images to support the text,   Voted Yes.

Commented:
may give this a try at home.  Not happy with Outlook 2013.

Commented:
Well done. I have been a faithful Pegasus user for the last 23 years. It has always done what I have needed to to do. It scales very well, especially in a school environment where pupils and staff move around to different workstations, but need to access their emails in a consistant manner. Of course, for the full benefit of Pegasus, it should be used with Mercury32, mail server package also written by Davis Harris.
CERTIFIED EXPERT

Commented:
Nice share , will give it try....  Voted YES.
Alexa JacksonDigital Forensic Analyst

Author

Commented:
Thanks dear Yashwant.

Have a question about something in this article? You can receive help directly from the article author. Sign up for a free trial to get started.