Email foreincis

Emails are one of the most common forms of communication in todays society. Email’s architecture usually begins when a user composes a message and sends through an email server. A mail server is like an electronic post office, it is designed to send and receive electronic mail. Once an email is sent, the sender’s mail server forwards the message through the organization’s network. Now the message is on the recipient’s mail server and is available to the recipient.

Personal information can be gained from email as well. Email senders can be identified by finding the IP address of the computer that was used to send the mail. It is easy to locate the IP address of any sender, however that sender might have been clever enough to use a public network. Another way to gain information is searching through the email’s header. Email headers contains tons of data about the email.

Email forensics refers to analyzing the source and content of emails as evidence. Email server investigation is a primary analytical technique. This involves investigating copies of delivered email and server logs. In some orgs they provide separate email boxes for their employees by having internal mail servers. In this case, investigation involves the extraction of the entire mail box related to the case and the server logs. Another analytical technique is attachment analysis, most viruses and malware are sent through email attachments. One software tool used to check whether the file is malware or not is VirusTotal.

less