Manipulate .eml text file

Hello all,

I have a project I’m working on where I’m looking to leverage PS to ingest the contents of a specific directory which will contain .eml text based email files. The point is to orchestrate and forward the email depending on variables such as the from and subject fields. Almost like using Outlook rules but more advanced.

For instance, read the file, if the subject is any 10-digit number, do X. If the subject is an email address anyName@anyDomain.tld, forward to that address.


I’m not worried about the specific rules yet. I need help reading the .EML file and assigning the content to variables.

Example .EML file:

Received: from [2XX.227.15.XX] by (XX Mail Server .NET v.1180) with ESMTP (EHLO for <>; Tue, 18 Jun 2019 09:24:53 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;; s=badeba3b8450; t=1560875092; bh=spaVaCYSN+YtghPh+WeUYg1gB5lMG1jrBTpomSjAWhc=; h=X-UI-Sender-Class:From:To:Subject:Date; b=GP8qDNDnV3BSzv6YVnTGs21Ne8vIGSoEkhQyq7EmQ9gbvx7NeqGazCJDwvf0PTga9 wGbiEo/w2FQjyhXfi002Y9G7jNaircdxjlrLQnUyobyDdro6dpIDNjC4WpZCV48XGy pefyCw549/RL0IHrRXiLXv2OHpxKaTQJotlbyBkM= X-UI-Sender-Class: 01bb95c1-4bf8-414a-932a-4f6e2808ef9c Received: from [172.58.XXX.144] ([172.58.XXX.144]) by msvc-mesg-gmx024.server.lan (via HTTP); Tue, 18 Jun 2019 18:24:51 +0200 MIME-Version: 1.0 Message-ID: <trinity-a95af8d3-1225-4ede-8597-4952030cb2e9-1560875091940@msvc-mesg-gmx024> From: "John Doe" <> To: Subject: test email Content-Type: text/html; charset=UTF-8 Importance: normal Date: Tue, 18 Jun 2019 18:24:51 +0200 X-Priority: 3 X-Provags-ID: V03:K1:XxkTL47Ltp+EdJBEo1Nk4KTavR0jO+IEzO7hTbOnq9QLsDT8NlGfVXrPci+82bJFYHN0S +jwfneig34aRqHAfVoHrsSRkEx7AM9TSDYYEUXj4LUbnlWBNZAoYaG9RfrBQ41oxGoXAu+pLWE9U fmQFpLpB6jNmq86nlwJN5Ef2k/Q8Wz4yi4EqMczmwOxDm+HCr5LGd1Hbrc9hPG8XlhZPcZLusMdE YydwP7+LmVebapkToSifuPFsXoenD84biTlS4s+T3smzcChgzaBnQMGHt+FMdOjPuEfbfZDKNKWZ cIwC7wcp5AQT5w7xa++SyRJ X-Spam-Flag: NO X-UI-Out-Filterresults: notjunk:1;V03:K0:wRgyz4NEdNo=:ITjypKbQU9UWLhKi+z+Pjr LFaTNuYOU4mr5zzYaN/l1A0okiV3NKAZZbRPgpNjx6CUviUTbpfat33fXLvyFZytysSrZMjZe cyUCqHP+xd2QEi2cNJFbdINwYDFPo63DYYDzb5Ln4iHd2sqJi5vfc7ju0MfpfKJgSwS0sA9Jx hdtMajydg1k1pF5ie+5ybRq4lOnsnyExUWkN+4riIdrc+XGLVED/V+J9yALi8ZRJifG9gSUen GDzeLhNcHd618cpMO4LfKrB7QlKFhLzfH3w0PlsAbe6gfI1qfT7V0HTV/ASBccKzr2iwDZMDz xZgek0dt/xbXy2U2x0580uI7d70crC7QUMqpWVibGOfd35hTziyPlZisFBX1/0CrzQV1xuIMM mpMeTRIBzZdvLRiiYBtwoVYnK5kuNtUdLo5TcR+054BnAizgd69IRE5jj1nuY/FoRbYGi04Sn 6mxjK5HSBF8h2XvJKa/iZwHShT4z5Zi9KAEBo5jyaLSidX/G6DTpv9x4qlqXvipSVGWdKlW4L OXD8t5rDoCz/toqYOtvWTlCl4dw9BqL9o7iV/L+RT7BPhKl16BvoDNTd2lSqfyxKssyyRX7ro ICMTRnsDziMhWisTUqwxq9GNa1KoR8Jpb8jfbPiF6f314EQvPfu2olU/b5aa4Z4TKutOfBFnA AWkuF38zq7I0pmfFKzLc4RHIguivmf0nWMVjVkX68r9ycFYs+scnP6MjaYyU+2Zm3KqR0BtX0 Ny/TgS/+EmAbNf6d6XOYQURVKg4Qp7gDXWCqkA== X-FromIP: 212.XXX.15.19 Authentication-Results:; spf=none (no checking performed); dkim=none (no checking performed)

<html><body>this is a test message<br>

The goal is to get these items assigned to a variable so that I can manipulate them: from, to, subject, and the body.

Here is what I have this far:

#Set the mail server mailbox directories
$inboxDir = 
$sentDir = 
$trashDir = 

$emailItem = Get-ChildItem -Path $inboxDir | Where-Object {!

ForEach($i in $emailItem){
#Set the .EML file to fName
$fName = $i.Name

  #Print the file name
  $fullLoc = "$inboxDir\$fName"
  echo $fullLoc

  #Find FROM:user@domain.tld in the .EML file
  Get-Content -Path $inboxDir"\"$fName | Where-Object {$_ -like 'From:'}



Try below which uses the switch statement.

switch -regex (Get-Content -Path 'C:\temp\testeml.eml') {
'' {$_ -replace '','}
# similarly other replaces 
default {$_}

Using Select-String and a regex pattern, you can pull out the sections of the text block that you want. The output object will contain the value of the matched text. For example:

$path = "$inboxDir", "$fName" -join '\'
$from = Select-String -Path $path -Pattern '(?<=From: ).*$'
"John Doe"

You can change the text in the look-behind part of the regex to get the other values, e.g.

$subject = Select-String -Path $path -Pattern '(?<=Subject: ).*$'
test email
$path = "$inboxDir", "$fName" -join '\'
$from = Select-String -Path $path -Pattern '(?< =From: ).*$'

Threw an error.

Using just -Pattern ‘From:’ does loop and display all the various times the word shows up in the .eml files but it does not include the trailing email address.

Also tried -Pattern ‘@’ since the @ symbol is a constant I can depend on to be in the .eml but got scripting error.


@powershell_noob - Didn’t switch model work for you ?

Yeah, sorry, the regex should look like <script src=“”></script>
There should not be a space between ‘<’ and ‘=’. It seems the forum is doing something odd when it parses the less than symbol and adding an unnecessary space.