Mobile Device Forensic
Kila
ch11.pptxGuide to Computer Forensics and Investigations Sixth Edition Chapter 11
E-mail and Social Media Investigations
‹#›
Guide to Computer Forensics and Investigations Sixth Edition
Chapter 11
E-mail and Social Media Investigations
1
Explain the role of e-mail in investigations
Describe client and server roles in e-mail
Describe tasks in investigating e-mail crimes and violations
Explain the use of e-mail server logs
Describe some specialized e-mail forensics tools
Explain how to apply digital forensics methods to investigating social media communications
Objectives
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
An increase in e-mail scams and fraud attempts with phishing or spoofing
Investigators need to know how to examine and interpret the unique content of e-mail messages
Phishing e-mails contain links to text on a Web page
Attempts to get personal information from reader
Pharming - DNS poisoning takes user to a fake site
A noteworthy e-mail scam was 419, or the Nigerian Scam
Exploring the Role of E-mail in Investigations (1 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Spoofing e-mail can be used to commit fraud
Investigators can use the Enhanced/Extended Simple Mail Transfer Protocol (ESMTP) number in the message’s header to check for legitimacy of email
Exploring the Role of E-mail in Investigations (2 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
E-mail can be sent and received in two environments
Internet
Intranet (an internal network)
Client/server architecture
Server OS and e-mail software differs from those on the client side
Protected accounts
Require usernames and passwords
Exploring the Roles of the Client and Server in E-mail (1 of 3)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Exploring the Roles of the Client and Server in E-mail (2 of 3)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Name conventions
Corporate: [email protected]
Public: [email protected]
Everything after @ belongs to the domain name
Tracing corporate e-mails is easier
Because accounts use standard names the administrator establishes
Many companies are migrating their e-mail services to the cloud
Exploring the Roles of the Client and Server in E-mail (3 of 3)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Similar to other types of investigations
Goals
Find who is behind the crime
Collect the evidence
Present your findings
Build a case
Know the applicable privacy laws for your jurisdiction
Electronic Communications Privacy Act (ECPA) and the Stored Communications Act (SCA) apply to e-mail.
Investigating E-mail Crimes and Violations (1 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
E-mail crimes depend on the city, state, or country
Example: spam may not be a crime in some states
Always consult with an attorney
Examples of crimes involving e-mails
Narcotics trafficking
Extortion
Sexual harassment and stalking
Fraud
Child abductions and pornography
Terrorism
Investigating E-mail Crimes and Violations (2 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Forensic Linguistics
Where language and law intersect
Four categories:
Language and law
Language in the legal process
Language as evidence
Research/teaching
Encompasses civil cases, criminal cases, cyberterrorism cases, and other legal proceedings
Understanding Forensic Linguistics
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Access victim’s computer or mobile device to recover the evidence
Using the victim’s e-mail client
Find and copy any potential evidence
Access protected or encrypted material
Print e-mails
Guide victim on the phone
Open and copy e-mail including headers
You may have to recover deleted e-mails
Examining E-mail Messages (1 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Copying an e-mail message
Before you start an e-mail investigation
You need to copy and print the e-mail involved in the crime or policy violation
You might also want to forward the message as an attachment to another e-mail address
With many GUI e-mail programs, you can copy an e-mail by dragging it to a storage medium
Or by saving it in a different location
Examining E-mail Messages (2 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Investigators should learn how to find e-mail headers
GUI clients
Web-based clients
After you open e-mail headers, copy and paste them into a text document
So that you can read them with a text editor
Become familiar with as many e-mail programs as possible
Often more than one e-mail program is installed
Viewing E-mail Headers (1 of 5)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Outlook
Double-click the message and then click File, Properties
Copy headers
Paste them to any text editor
Save the document as Outlook header.txt in your work folder
Viewing E-mail Headers (2 of 5)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Viewing E-mail Headers (3 of 5)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Gmail
Click the down arrow next to the Reply circular arrow, and click Show original
Click the Download Original link to open the “Opening original_msg.txt” dialog box
Click Open with Notepad (default) and click Okay
Save the file in your work folder with the default name
Yahoo
Click Inbox to view a list of messages
Above the message window, click More and click View Raw Message
Copy and paste headers to a text file
Viewing E-mail Headers (4 of 5)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Viewing E-mail Headers (5 of 5)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Headers contain useful information
The main piece of information you’re looking for is the originating e-mail’s IP address
Date and time the message was sent
Filenames of any attachments
Unique message number (if supplied)
Examining E-mail Headers (1 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Examining E-mail Headers (2 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
E-mail messages are saved on the client side or left at the server
Microsoft Outlook uses .pst and .ost files
Most e-mail programs also include an electronic address book, calendar, task list, and memos
In Web-based e-mail
Messages are displayed and saved as Web pages in the browser’s cache folders
Many Web-based e-mail providers also offer instant messaging (IM) services
Examining Additional E-mail Files
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Determining message origin is referred to as “tracing”
Contact the administrator responsible for the sending server
Use a registry site to find point of contact:
www.arin.net
www.internic.com
www.google.com
Verify your findings by checking network e-mail logs against e-mail addresses
Tracing an E-mail Message
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Router logs
Record all incoming and outgoing traffic
Have rules to allow or disallow traffic
You can resolve the path a transmitted e-mail has taken
Firewall logs
Filter e-mail traffic
Verify whether the e-mail passed through
You can use any text editor or specialized tools
Using Network E-mail Logs (1 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Using Network E-mail Logs (2 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
An e-mail server is loaded with software that uses e-mail protocols for its services
And maintains logs you can examine and use in your investigation
E-mail storage
Database
Flat file system
Logs
Some servers are set up to log e-mail transactions by default; others have to be configured to do so
Understanding E-mail Servers (1 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
E-mail logs generally identify the following:
E-mail messages an account received
Sending IP address
Receiving and reading date and time
E-mail content
System-specific information
Contact suspect’s network e-mail administrator as soon as possible
Servers can recover deleted e-mails
Similar to deletion of files on a hard drive
Understanding E-mail Servers (2 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Common UNIX e-mail servers: Postfix and Sendmail
/etc/sendmail.cf
Configuration file for Sendmail
/etc/syslog.conf
Specifies how and which events Sendmail logs
Postfix has two configuration files
master. cf and main.cf (found in /etc/postfix)
Examining UNIX E-mail Server Logs (1 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
/var/log/maillog
Records SMTP, POP3, and IMAP4 communications
Contains an IP address and time stamp that you can compare with the e-mail the victim received
Default location for storing log files:
/var/log
An administrator can change the log location
Use the find or locate command to find them
Check UNIX man pages for more information
Examining UNIX E-mail Server Logs (2 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Microsoft Exchange Server (Exchange)
Uses a database
Based on Microsoft Extensible Storage Engine (ESE)
Most useful files in an investigation:
.edb database files, checkpoint files, and temporary files
Information Store files
Database files *.edb
Responsible for MAPI information
Examining Microsoft E-mail Server Logs (1 of 4)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Transaction logs
Keep track of changes to its data
Checkpoints
Marks the last point at which the database was written to disk
Temporary files
Created to prevent loss when the server is busy converting binary data to readable text
Examining Microsoft E-mail Server Logs (2 of 4)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
To retrieve log files created by Exchange
Use the Windows PowerShell cmdlet GetTransactionLogStats.ps1 -Gather
Tracking.log
An Exchange server log that tracks messages
Another log used for investigating the Exchange environment is the troubleshooting log
Use Windows Event Viewer to read the log
Examining Microsoft E-mail Server Logs (3 of 4)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Examining Microsoft E-mail Server Logs (4 of 4)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Tools include:
DataNumen for Outlook and Outlook Express
FINALeMAIL for Outlook Express and Eudora
Sawmill-Novell GroupWise for log analysis
MailXaminer for multiple e-mail formatas and large data sets
Fookes Aid4Mail and MailBag Assistant
Paraben E-Mail Examiner
AccessData FTK for Outlook and Outlook Express
Ontrack Easy Recovery EmailRepair
R-Tools R-Mail
OfficeRecovery’s MailRecovery
Using Specialized E-mail Forensics Tools (1 of 3)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Tools (continued)
MXToolBox for decoding e-mail headers
FreeViewer with free tools for various servers
Tools allow you to find:
E-mail database files
Personal e-mail files
Offline storage files
Log files
Advantage of using data recovery tools
You don’t need to know how e-mail servers and clients work to extract data from them
Using Specialized E-mail Forensics Tools (2 of 3)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
After you compare e-mail logs with messages, you should verify the:
Email account, message ID, IP address, date and time stamp to determine whether there’s enough evidence for a warrant
With some tools
You can scan e-mail database files on a suspect’s Windows computer, locate any e-mails the suspect has deleted and restore them to their original state
Using Specialized E-mail Forensics Tools (3 of 3)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Magnet AXIOM has two modules:
Process
Examine
Follow the steps in the activity on page 472 to learn how to use Magnet AXIOM to recover e-mails
Using Magnet AXIOM to Recover E-mail (1 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Using OSForensics to Recover E-mail (2 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Few vendors have products for analyzing e-mail in systems other than Microsoft
mbox format
Stores e-mails in flat plaintext files
Multipurpose Internet Mail Extensions (MIME) format
Used by vendor-unique e-mail file systems, such as Microsoft .pst or .ost
Example: carve e-mail messages from Evolution
Using a Hex Editor to Carve E-mail Messages (1 of 4)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Using a Hex Editor to Carve E-mail Messages (2 of 4)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Using a Hex Editor to Carve E-mail Messages (3 of 4)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
39
Using a Hex Editor to Carve E-mail Messages (4 of 4)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
A forensics examiner recovering e-mail messages from Outlook
May need to reconstruct .pst files and messages
With many advanced forensics tools
Deleted .pst files can be partially or completely recovered
Scanpst.exe recovery tool
Comes with Microsoft Office
Can repair .ost files as well as .pst files
Recovering Outlook Files (1 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Guidance Software uses the SysTools plug-in
For Outlook e-mail through version 2013
Systools extracts .pst files from EnCase Forensic for analysis
DataNumen Outlook Repair
One of the better e-mail recovery tools
Can recovery files from VMware and Virtual PC
Recovering Outlook Files (2 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
In the Enron Case, more than 10,00 emails contained the following personal information:
60 containing credit card numbers
572 containing thousands of Social Security or other identity numbers
292 containing birth dates
532 containing information of a highly personal nature
Such as medical or legal matters
E-mail Case Studies
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Online social networks (OSNs) are used to conduct business, brag about criminal activities, raise money, and have class discussions
Social media can contain:
Evidence of cyberbullying and witness tampering
A company’s position on an issue
Whether intellectual property rights have been violated
Who posted information and when
Applying Digital Forensics to Social Media Communications (1 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Social media can often substantiate a party’s claims
OSNs involve multiple jurisdictions that might even cross national boundaries
A warrant or subpoena is needed to access social media servers
In cases involving imminent danger, law enforcement can file for emergency requests
Applying Digital Forensics to Social Media Communications (2 of 2)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Mobile devices
Majority of social network clients
Evidence artifacts vary depending on the social media channel and the device
iPhone and Android devices
Yielded the most information, and much of the data was stored in SQLite databases
Social Media Forensics on Mobile Devices
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Software for social media forensics is being developed
Not many tools are available now
There are questions about how the information these tools gather can be used in court or in arbitration
Using social media forensics software might also require getting the permission of the people whose information is being examined
Forensics Tools for Social Media Investigations
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
E-mail fraudsters use phishing, pharming, and spoofing scam techniques
In both Internet and intranet e-mail environments, e-mail messages are distributed from one central server to connected client computers
E-mail investigations are similar to other kinds of investigations
Forensics linguistics is a field where language and the law intersect to determine the author of e-mails, text messages, and other online communications
Access victim’s computer to recover evidence
Copy and print the e-mail message involved in the crime or policy violation
Summary (1 of 3)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
Use the e-mail program that created the message to find the e-mail header, which provides supporting evidence and can help you track the suspect to the originating location
Investigating e-mail abuse
Be familiar with e-mail servers and clients’ operations
For many e-mail investigations you can rely on e-mail message files, headers, and server log files
Summary (2 of 3)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
For e-mail applications that use the mbox format, a hexadecimal editor can be used to carve messages manually
Social media, or OSNs can provide evidence in criminal and civil cases
Software for collecting OSN information is being developed
The majority of people engaging in social media communications are mobile users
Social media forensics tools have evolved with the technology, and many forensics suites have built-in social media tools
Summary (3 of 3)
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.
‹#›
