Chapter 10
Email Forensics
1
Email is Often the Best Evidence
Contents can demonstrate intent
Header data can demonstrate the source
Timestamps can show intent to mislead
Show up as evidence in a vast majority of cases
Email Structure
Plain text emails dont support graphics
HTML structured emails support graphics and embedded content
Attachments can accompany the message as a separate file
Email Technology
Mail user agent is a software interface that represents the end user
Mail transport agent moves messages from point A to point B
Mail client is the application that provides end user support
Mail server handles addressing and transport
Email Addresses
Each user ID must be unique to a particular domain
The same user ID on a different domain may or may not represent the same user
User IDs are easily spoofed with the right softwareUsing Chapter10as a reference,eExplain the concept of information stores.Why is an understanding of how different clients store messaging information critical to the success of an email search?
Recent Comments