1 / 7

F11-Email Activity Reconstruction

F11-Email Activity Reconstruction. Dr. John P. Abraham Professor UTPA. E-Mail. The first step in an email examination is to identify the sources of email and how the email servers and clients are used in an organization. emails can forensically extracted even after deletion.

arien
Télécharger la présentation

F11-Email Activity Reconstruction

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. F11-Email ActivityReconstruction Dr. John P. Abraham Professor UTPA

  2. E-Mail • The first step in an email examination is to identify the sources of email and how the email servers and clients are used in an organization. • emails can forensically extracted even after deletion. • Usually, reconstruction of e-mail requires your forensic workstation to have the same application installed. This chapter also presents some tools that can read the e-mail without the original application so that your analysis will be more efficient. • Most common email clients are outlook and outlook express

  3. Outlook Express • Tool: Eindeutig (means express in German). • Outlook express file is kept with a *.dbx extension. • Each user is given a unique lengthy identifier in the identities folder followed by \microsoft\outlook express\ • It is hard to type the unique identifier. So copy it and paste it. You can find it in the store location • Start Outlook Express. • Click Tools, and then click Options. • On the Maintenance tab, click Store Folder. • In the Store Location dialog box, copy the store location. • Attachments to emails can be reconstructed with a tool called munpack. This tool is for MIME file attachments.

  4. Outlook • Mail uses .pst extension. • You can export it other formats within outlook. • libPST can be used under linux. You can emulate linux under windows using the cygwin • Cygwin is a Linux-like environment for Windows. It consists of two parts: • A DLL (cygwin1.dll) which acts as a Linux API emulation layer providing substantial Linux API functionality. • A collection of tools which provide Linux look and feel.

  5. Email Headers • The email header is the information that travels with every email, containing details about the sender, route and receiver. • who sent the email, the route, who is the receiver and when it was received. • Outlook • Go to the message • Look at the properties of the email or view options • Different email accounts does it differently. Yahoo –right click on a message and click show full header.

  6. Commercial Forensic tools • FTK – • To reconstruct non-web based email in FTK, the processes is straightforward and simple. • Load the forensic duplication of the suspect’s computer system into FTK • Make sure you process the forensic duplication so that FTK identifies e-mail documents. • Click on the “Email” tab on the overview screen • FTK will present all the e-mail it detected in the lower window pane in an HTML-Like view. • FTK will NOT recognize every e-mail repository format that exists. • Paraben’s Network Email Examiner. http://www.paraben-forensics.com

More Related