Skip to content
Krellix

Documentation · Personal setup

Personal mode: collect your own correspondence.

Personal mode is the minimal-friction path for solo operators preserving their own email with a named contact. It does not require admin consent, mailbox permission grants, or any coordination with IT.

What Personal mode does

Personal mode queries your own mailbox (/me/messages) and filters for messages to or from a named contact. The output is the same as any Krellix collection — native .eml, searchable PDFs, SHA-256/MD5 hash manifest, RFC 3161 timestamp, chain-of-custody manifest — but the custodian in the manifest is always you.

If you need to collect from someone else's mailbox (a paralegal pulling a partner's correspondence, an HR investigator collecting a subject's messages), use Enterprise mode instead — Personal is not the right tool.

Prerequisites

  • A Microsoft 365 mailbox — any license that includes Exchange Online is enough. Business Basic, Business Standard, Business Premium, and all E-plans work.
  • Or any IMAP mailbox — Gmail (with an app password), iCloud, Yahoo, Fastmail, or a self-hosted IMAP server. Non-Microsoft paths skip the MSAL sign-in entirely.
  • Windows 10 or 11, with at least 500 MB of disk space per 10,000 messages you expect to collect.

Sign in

  1. Launch Krellix Mail. On the mode selector, choose Personal and click Continue.
  2. On the sign-in screen, pick either Microsoft 365 or IMAP. The flows diverge here; the rest of this guide assumes Microsoft 365. For IMAP, enter your server, port, username, and password (or app password for Gmail/Yahoo) — Krellix then connects over STARTTLS or TLS.
  3. For Microsoft 365, click Sign in with Microsoft. Your default browser opens to login.microsoftonline.com. Enter your credentials as you would for Outlook on the web.
  4. On the first sign-in, Microsoft shows a consent dialog listing three scopes: Mail.Read, User.Read, and offline_access. Approve. These are all user-consentable scopes — no admin approval is required.

AADSTS90094. If you see this error on your own tenant, your tenant admin has the “Let Microsoft manage your consent settings” option turned on with a restrictive policy. Either ask your admin to approve the Krellix app for the tenant (the app listing ID is in the error) or switch to IMAP, which bypasses Entra consent entirely.

Scope the collection

The main collection screen has four fields:

  • Contact — the email address or display name of the person you corresponded with. Krellix uses this to filter to messages where the contact is either the sender or a recipient. You can enter multiple contacts separated by semicolons.
  • Date range — optional. If left blank, Krellix collects everything that matches the contact filter.
  • Folder scope — by default, Krellix searches all folders including Deleted Items and Archive. You can restrict to Inbox + Sent Items if you want a narrower set.
  • Output folder — where the export will land on disk. Krellix creates a timestamped subfolder named krx-[YYYYMMDD-HHMMSS]-[contact] under this path.

Once the fields are set, Krellix renders the translated Microsoft Graph $filter expression in a read-only box below the form. This is the literal query that will be sent — if you know KQL, read it once before clicking Run.

Run

Click Run export. Krellix performs a pre-flight MailFolders.GetAsync(Top=1) against your mailbox to confirm the token works, then begins streaming messages. Progress updates every 50 messages.

Keep the machine awake. Krellix does not put the machine into sleep — if your Windows power settings would normally sleep after 30 minutes of inactivity, Krellix's ongoing network calls and disk writes count as activity for most settings, but not all. If you're running a multi-thousand-message collection, plug in.

Output

When the collection finishes, Krellix writes the manifest, hashes it, and sends the hash to DigiCert's public Time Stamp Authority. A notification appears when the timestamp token is stored. The export folder is now sealed.

Open the export folder to see the seven-folder structure. Hand it off as-is, or zip it first — the contents are all open formats, so the recipient doesn't need Krellix to read them.

Next steps