.mbox archives are treated as containers: each message inside becomes its own scan unit, just like an entry inside a .zip. Findings stream to disk per message, and the file_path in JSONL output carries the message ordinal (and Message-ID: when present) — for example mail.mbox::message-000042::<[email protected]>. Headers (From, To, Cc, Bcc, Subject, Reply-To), bodies, and decoded attachments are all scanned. The streaming reader handles multi-gigabyte mboxes (Gmail Takeout exports) without loading the whole file into memory. See Scan Gmail for PII for a walkthrough.
🗄️ Database flat-files
Common Name
Extension(s)
SQLite
.sqlite, .sqlite3, .db, .db3
Microsoft Access
.mdb, .accdb
Database files are opened read-only, every user table is dumped to text, and the resulting text is run through PII detection.