Email forensics

What is Email Forensic Investigation?

Email forensics may be a branch of digital forensic science that focuses on investigation of emails to gather digital evidence for crimes and incidents. It comprises in-depth & systematic examination of emails, especially aspects like message transmission routes, attached files and documents, IP addresses of servers and computers, etc.

Email is one of the most popular services used over the internet and has become a primary source of communication for organizations and the public. Usage of email services in business activities like banking, messaging and sending file attachments increased at a tremendous rate. This medium for communication has become vulnerable to different kinds of attacks. Hackers can forge the email headers and send the email anonymously for their malicious purposes. Hackers can also exploit open relay servers to carry out massive social engineering. Email is the most common source of phishing attacks. To mitigate these attacks and catch the people responsible, we use email forensics and techniques like performing header analysis, server investigation, sender mailer fingerprints etc. Email forensics is the analysis of source and content of the email message, identification of sender and receiver, date and time of email and the analysis of all the entities involved. Email forensics also reforms to the forensics of client or server systems suspected in an email forgery.

Email forensics professionals use the following common techniques to examine emails and collect digital evidence:

1. Email Header Analysis

Email headers contain important information including name of the sender and receiver, the path (servers and other devices) through which the message has traversed, etc. Some of the important email header fields are highlighted in Figure 1.

The vital details in email headers can help investigators and forensics experts in email investigation. For instance, the Delivered-To field contains email address of recipient and the Received-By field contains last visited SMTP server’s IP address, its SMTP ID, and the date and time at which the email is received. Similarly, the Received: from field provides key details like IP address of sender and host name. Such information can be instrumental in identifying the culprit and collecting evidence.

2. Email Server Investigation

Email servers are investigated to locate the source of an email. If an email is deleted from client application, sender’s or receiver’s, then related ISP or Proxy servers are scanned as they usually save copies of emails after delivery. Servers also maintain logs that can be analyzed to identify the address of the computer from which the email is originated.

It is worth noting that HTTP and SMTP (common messaging initiation protocol) logs are archived frequently by large ISPs. If a log is archived then tracing relevant emails can take a lot of time and effort, as it requires decompressing and extraction techniques. Therefore, it is best to examine the logs as soon as possible.

3. Investigation of Network Devices

In some cases, logs of servers are not available. This can happen due to many reasons such as when servers are not configured to maintain logs or when an ISP refuses to share the log files. In such an event, investigators can refer to the logs maintained by network devices such as switches, firewalls, and routers to trace the source of an email message.

4. Sender Mailer Fingerprints

X-headers are email headers that are added to messages along with standard headers, like Subject and To. These are often added for spam filter information, authentication results, etc., and can be used to identify the software that is handling the email at the client such as Outlook or Opera Mail. X-originating-IP header can be used to find the original sender, i.e. IP address of the sender’s computer.

5. Software Embedded Identifiers

Sometimes, the email software used by a sender can include additional information about the message and attached files in the email. It can be found in MIME content as a Transport Neutral Encapsulation Format (TNEF) or custom header. An in-depth analysis of these sections can reveal vital details related to the sender like MAC address, Windows logon username of the sender, PST file name, and more.

6. Bait Tactics

Bait tactic is an email investigation technique that is used when the location of a suspect or cybercriminal is unknown. In this, the investigators send an email that contains a http: “<img src>” tag to the suspect. The image source is at a computer that is monitored by the investigators. When the suspect opens the email, the computer’s IP address is registered in a log entry on the HTTP server that hosts the image. The investigators can use the IP address to track the suspect.

Sometimes, suspects take precautionary measures like using a proxy server to protect their identity. In that case, the IP address of the proxy server is recorded. However, the log on the proxy server can be analyzed to track the suspect. If the log isn’t available either, then the investigator can send an email that contains either of the following:

• HTML page with an Active X Object.
• Embedded Java Applet that is configured to run on the recipient’s computer.

Both of these can record the IP address of the suspect’s computer and send the same to the email address of the investigators.

Email forensics tools

• EmailTrackerPro 
• Xtraxtor
• Advik (Email backup tool)
• Systools MailXaminer
• Adcomplain