E-mail Forensics

Content Leader: Jess Garcia - Last Updated: January 21, 2007

Gral Information

Standards

• RFC 2821 - RFC 2822

E-mail Messages

Fields

• Message-ID: Optional, but every message should have it
  • Intended to be machine readable.
  • Format: <date/time.unique_id@domain>
    • Date/Time Integer: Can be formatted to display human readable date/time, but is usually in a hexadecimal string. On Unix systems, the string represents the “number of microseconds since midnight, January 1, 1970, Greenwich Mean Time.” (Unix Time – epoch)
    • If hexadecimal, convert it to decimal and then convert from Unix timestamp to date/time format.

Structure

• E-mail messages are divided in several parts:
  • Envelope Header - Added by E-mail servers
  • Message Header - Added by the E-mail client
  • Body
  • Attachments

References

• Investigations Involving the Internet and Computer Networks - U.S. Department of Justice - Chapter 3
• Email Forensics - William L. Farwell
• Webmail Forensics - Thomas Akin