Email Forensics GuideBook – Investigation Became Easy With Right Software

Email header plays a crucial role in identifying the sender of an email. Many fields can be forged within the header part but it still gives enough information about the sender. The investigator upon performing the email header forensics will able to identify the following:

Other information in the email header that indirectly will help you during the forensics process:

The header fields in general are written from bottom to top hence the best way for the email forensics investigator is to analyze all those fields from bottom to top. So whatever is done initially by the sender's client/server during the composition and sending of email those fields will be located at the very bottom of the header part of the concerned email.

Forensics of Email Metadata information

The Email forensic investigator can use several header fields to trace the email but it can be broadly categorized into the following area of interest the investigator should look into:

• Sender's SMTP Server (OUTGOING Mail Server)
• Encrypted mail header
• Typical To, From, Subject, and Date Lines
• Mail transfer email client information
• Various X-header information added by different SMTP server and email clients during the whole email sending process.

A simple DNS lookup after finding the source ip (26.126.148.104 in this case) will reveal the server location, as one can see in the image as well.

• Obtain a search warrant and seize the accused computer and email account
• Obtain a Bit-by-Bit Image of the concerned Email data
• Through Examination of Email Header
• Trace the origin of the concerned email.
• Acquire email archive
• Recover Deleted Emails
• Present the case in admissible format.

Email clients such as Outlook, Entourage are standalone applications installed on users computer designed to send, receive and organize emails.

• It retrieves emails from the mailbox (user's Incoming mail server via pop3/imap4 protocol)
• Allows user to create new email and send it to the user's outgoing email server (SMTP Server via SMTP protocol)
• Display header part of all emails in user's mailbox

Window Search Index: There will be time when emails files are scattered and when doing search in Gigabytes of data it becomes hard to locate all the emails. When performing email computer forensics the investigator can use the Window Search Index features to locate the email files. Window search index maintains a record any document/application on the computer including the content of the files hence with right keyword and file type search you will be able to locate all the emails indexed by Windows Search instantly.

Windows search will greatly help in computer forensics of email as you can sort the document type that you are interested in KWs you are looking for and extension to search. By combining all the parameters you will be able to easily get all the email that exists within the disk/drive.

Network Status: Almost all laptop/Desktop comes with pre-installed NIC Cards (Network interface cards) and provides interface to the host machine with the outside world (network) and can play significant role in email forensics. Many web based email service provider records the IP address of the originating system from where the email was composed and dispatched to the receiver. Ipconfig command will help you to locate all the NICs on the computer.

Parsing Process Memory: Processor memory (RAM) also holds key information and one might get useful information such as IP and email addresses if one is able to parse through the content of RAM Dump.

Internet Explorer: During your forensic search for emails in computer system you can use the data stored by internet explorer to know a bit or two about the emails such as which email provider the user usually logins to and most frequently site visited.

Memory Forensics for email artifacts recovery

You can track and map user's activities via the memory artifact created by the operating system or application (outlook for instance) that will give you hold on some of the exclusive evidence that you otherwise would not find. One can find some of these data in the memory:

• Unencrypted e-mail messages
• Private email structure
• Mapped files
• Internet history records that usually does not get cached by the browser.
• Content processed by the application

Though the majority of critical component you will find in the data you collected that reside in the persistent storage medium, you will be able to capture invaluable evidence to reconstruct the event.

Ease, speed and relative anonymity of email makes it lucrative option for committing crimes for the criminals. Email crimes can be broadly divided into two main categories:

Crimes that are committed by sending an email, such as:

• Email Spamming: In simple term it can be defined as sending unsolicited emails. Email Spammers generally obtains the email ids from webpages, DNS listing and every other possible source and send unsolicited emails to the gathered email database.
• Mail Bombing: The primary intension of mail bombing is to cause denial-of-service attack to the victim by sending huge volumes of emails to the victim's mailbox/server to crash down.
• Phishing: It is criminal act of sending an unsolicited and illegitimate email falsely claiming to be from legitimate site/company in order to win the victim's trust and acquire their personal/account information by redirecting them to fake webpages of the trustworthy sites and asking them to input the data.
• Email Spoofing: is the act of forging the email header so that the message appears to originate from source other than the actual source. The perpetrator might attach Trojan, virus or warm files as attachments file in the email.
• Email Sphere fishing: In this email fraud the perpetrator will ask for confidential and sensitive information. This type of attack resembles with e-mail spoofing fraud but in here in almost all cases the sender is someone trustworthy with an authoritative position in the organization.

  

If you suspect the email is of Sphere fishing type then you can use the following email fields to gain information:

• From and Reply-To Field
• Subject Line
• Unique Message ID (ESMTP)
• URL (if any) the email is prompting the user to visit, this url will also revel the domain the perpetrator used to lure the victim. Check the Whois for further information.
• Received Field to identify the originating IP address or at least the SMTP server of the sender.

• The CAN-SPAM Act of 2003 establish requirements for those who send commercial emails, spells out penalties for spammers and companies whose products are advertised in spam.
• 18 U.S. Code § 2252A & 2252B: This law prevents and punishes the culprit in cases concerning crimes that have been committed using the digital means. This law also takes care of the Email Malpractices.
• RCW 19.190.20: This law governs to the resident of Washington and prohibits any person from commercial transmission of electronic mail messages.
• Stored Communications Act (18 U.S.C. §§ 2701-12): This act protect the owner's file content that are stored by the service provider from any unauthorized use failing which there are many civil and criminal penalties for the act hence the forensics expert need to submit specific proof before a court order or search warrant can be issued against the alleged person.