Identify the implementation
In common mbox implementations, a mailbox's messages are combined in one file. Maildir generally uses individual message files within a directory structure. Implementations and associated metadata differ, so identify the server or client, version, configuration and export history. Linux alone does not establish which format or service was used.
Context can matter
Directories, filenames, flags, indexes and configuration may help interpret message state. A loose collection of copied message files can lose relationships or supporting metadata. An export to mbox may be a derived representation of an entirely different source system. Preserve that distinction and do not describe every mbox file as a direct server acquisition.
Examine copies carefully
Record the original paths, file hashes, collection time and available permissions. Coordinate collection of a running service with authorised administrators so that consistency and operational needs are addressed. Do not run a repair or re-import over the only copy to see whether it works. Readable content can support comparison and chronology, but deleted material, envelope information and complete historical state are not guaranteed. Assess backups, logs and other participants' copies as separate sources where the question requires them.
Sources & further reading
Primary references support the technical explanation. They do not establish D3 validation of a particular method.