Skip to content
EML-031 Email Evidence

What is MIME and why does it matter?

title: What is MIME and why does it matter? subtitle: MIME is the structure that lets one email contain alternative bodies, attachments, images and other message parts. slug: what-is-mime-and-why-does-it-matter series: email-evidence section: content-and-attachments card_type: question_card pathway_order: 27 section_order: 5 status: draft public_safe: true video_ready: true word_count: 631 estimated_read_time_seconds: 261 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - MIME - multipart - attachment - message structure sources: - title: 'RFC 2045: Multipurpose Internet Mail Extensions (MIME) Part One' url: https://www.rfc-editor.org/info/rfc2045/ - title: 'RFC 2046: Multipurpose Internet Mail Extensions (MIME) Part Two' url: https://www.rfc-editor.org/info/rfc2046/ - title: 'RFC 2183: Communicating Presentation Information in Internet Messages' url: https://www.rfc-editor.org/info/rfc2183/ - title: 'RFC 2387: The MIME Multipart/Related Content-Type' url: https://www.rfc-editor.org/info/rfc2387/ - title: 'RFC 9787: Guidance on End-to-End Email Security' url: https://www.rfc-editor.org/info/rfc9787/

What is MIME and why does it matter?

MIME is the structure that lets one email contain alternative bodies, attachments, images and other message parts.

Script

MIME is the structure that allows an email to contain more than a simple block of plain text.

The letters originally stand for Multipurpose Internet Mail Extensions.

For an investigator, the name matters less than the practical point:

The email you see on screen may be assembled from several separate parts.

One part may contain plain text.

Another may contain HTML.

Another may be a PDF attachment.

Another may be an image displayed inside the HTML.

Another may be a complete email attached to the message.

MIME defines how those parts are labelled, encoded and related to one another.

A mail client reads that structure and decides what to display.

That means the visible message is a rendering, not necessarily the complete source.

Common MIME structures include multipart/mixed, multipart/alternative and multipart/related.

Multipart/mixed is often used when a message contains a body and separate attachments.

Multipart/alternative is used when the sender provides different versions of substantially the same content, commonly plain text and HTML.

Multipart/related groups parts that belong together, such as an HTML body and images referenced from it.

Each part may carry fields such as:

Content-Type;

Content-Disposition;

Content-Transfer-Encoding;

Content-ID;

filename;

and character set.

Those fields help the mail client decide what the part is and how to present it.

But they are not infallible.

A sender can label content incorrectly or misleadingly.

A part declared as an image may contain something else.

A filename may not match the real file type.

A part marked inline may still be offered as an attachment by another mail client.

So MIME describes the message’s intended structure. It doesn’t prove that every label is true.

Why does this matter to an investigation?

Because different parts can contain different evidence.

The HTML body may contain a hidden link that isn’t present in the plain-text version.

The plain-text version may expose a destination that the HTML disguises behind a button.

An embedded image may be a separate MIME part linked through Content-ID.

An attached email may contain its own complete header and body inside the outer message.

An attachment may be encoded as text for transport and reconstructed by the mail client.

If you preserve only what appeared on screen, you may miss those parts and relationships.

MIME also explains why forwarding, copying or converting an email can lose information.

A forwarded message may flatten the original body into quoted text.

A PDF may preserve the appearance but not the MIME tree.

Saving an image separately may break the link to its Content-ID and surrounding HTML.

Extracting an attachment without the email may remove the context showing how it was named and delivered.

You don’t need to become a MIME specialist before handling an email.

You do need to preserve the complete original so that somebody can inspect the structure later.

Where the structure matters, ask:

How many parts are present?

Which part is the main body?

Are there plain-text and HTML alternatives?

Which items are marked as attachments?

Are any images referenced by Content-ID?

Are any parts themselves complete messages?

Are there unusual or conflicting content types?

Which character encoding was used?

Does the client’s display match the raw structure?

Use tools that show the MIME tree rather than relying only on the mail client’s attachment list.

Keep extracted files linked to the original part from which they came.

The common mistake is:

“There was one email with one attachment.”

The raw message may contain several alternative bodies, inline images, remote references and attached message objects.

The opposite mistake is to make MIME sound more mysterious than it is.

It is simply the packaging system.

The investigator’s job is to preserve the package, understand which part answered which question and avoid confusing the rendered view with the complete evidence.

Key takeaway

What the recipient sees is a rendering of a MIME structure. Preserve and inspect the structure when the relationship between the parts matters.

Source notes

Keep moving

Where this question leads

These links explain why the next page may matter, rather than presenting an undifferentiated list.