Case study for Email-Forensics

 

Case study for Email-Forensics using open source tool

With the speedy growth in the world of digitization, emails have become a primary need among every individual for a seamless communication experience with the intended recipient. Although the advanced features may vary from one email application to another, moreover every email client provides basic functionality to send and receive the emails consisting of different crucial information. At times, these emails become the primary medium, which is vulnerable to several email frauds and attacks.

Role of Email in Investigation

Emails play a very important role in business communications and have emerged as one of the most important applications on internet. They are a convenient mode for sending messages as well as documents, not only from computers but also from other electronic gadgets such as mobile phones and tablets.

The negative side of emails is that criminals may leak important information about their company. Hence, the role of emails in digital forensics has been increased in recent years. In digital forensics, emails are considered as crucial evidence and Email Header Analysis has become important to collect evidence during forensic process.

An investigator has the following goals while performing email forensics:

• To identify the main criminal
• To collect necessary evidence
• To presenting the findings
• To build the case

Challenges in Email Forensics

Email forensics play a very important role in investigation as most of the communication in present era relies on emails. However, an email forensic investigator may face the following challenges during the investigation:

• Fake Emails: The biggest challenge in email forensics is the use of fake e-mails that are created by manipulating and scripting headers etc. In this category criminals also use temporary email which is a service that allows a registered user to receive email at a temporary address that expires after a certain time.
• Spoofing: Another challenge in email forensics is spoofing in which criminals used to present an email as someone else’s. In this case the machine will receive both fake as well as original IP address.
• Anonymous Re-emailing: Here, the Email server strips identifying information from the email message before forwarding it further. This leads to another big challenge for email investigations.
• Techniques Used in Email Forensic Investigation: Email forensics is the study of source and content of email as evidence to identify the actual sender and recipient of a message along with some other information such as date/time of transmission and intention of sender. It involves investigating metadata, port scanning as well as keyword searching.

Some of the common techniques which can be used for email forensic investigation are:

• Header Analysis
• Server investigation
• Network Device Investigation
• Sender Mailer Fingerprints
• Software Embedded Identifiers

Email headers contain vital information about the path that the message has traversed before reaching its final destination. This information includes recipients' and senders' names, time of sending/receiving the email message, email client, internet service provider (ISP), IP address of the sender, etc. (Header analysis).

Spam mail header analysis

First download spam mail.

After downloading it open it using any text editor. You will see the code. Copy this code 
and paste in header analyser online tool.

I used online site for email header analysis.

Analyser provides the following output.

We can see many information from this header analysis which is helpful in our email forensics.