Week 6 Discussion: Email Forensics

In Discussion Forum 5, post your response to the following discussion topic. Reply to at least two classmates’ responses and shares informative URLs by the date indicated in the Course Calendar. Each student posts their discussion assignments in Word Format into the Week 6 Discussion #5.

Questions:

(1) Email has become a primary communication medium for many official activities. You learned about the process of email forensics. Discuss the email architecture, email identities, and data, and also describe email forensics investigation procedures and techniques.

Grading Rubric for Discussion Forum 5

• Providing a comprehensive discussion of the topic: 25 percent
• Justifying ideas and responses by using appropriate examples and references from texts, Web sites, other references, or personal experience and cited the sources in the correct: 25 percent
• Commented on at least two of your classmates’ postings in a meaningful way (at least 100 words): 25 percent
• Filling the number of required at least 200 words or more for the discussion: 25 percent

You should be actively engaging with weekly discussions by providing peer-to-peer feedback. You need to make at least two comments on the responses posted by your classmates. You should be writing your response/feedback/comments/question at least two students in your class. This is to see your performance in online discussion.

computer sciencediscussion board

Emails are one of the most common forms of communication in todays society. Email’s architecture usually begins when a user composes a message and sends through an email server. A mail server is like an electronic post office, it is designed to send and receive electronic mail. Once an email is sent, the sender’s mail server forwards the message through the organization’s network. Now the message is on the recipient’s mail server and is available to the recipient.

Personal information can be gained from email as well. Email senders can be identified by finding the IP address of the computer that was used to send the mail. It is easy to locate the IP address of any sender, however that sender might have been clever enough to use a public network. Another way to gain information is searching through the email’s header. Email headers contains tons of data about the email.

Email forensics refers to analyzing the source and content of emails as evidence. Email server investigation is a primary analytical technique. This involves investigating copies of delivered email and server logs. In some orgs they provide separate email boxes for their employees by having internal mail servers. In this case, investigation involves the extraction of the entire mail box related to the case and the server logs. Another analytical technique is attachment analysis, most viruses and malware are sent through email attachments. One software tool used to check whether the file is malware or not is VirusTotal.

less

When an email is created and send, it travels through different mail servers on Internet before arriving to the required destination.
Email Architecture: The email uses Simple Mail Transfer Protocol (SMTP) to get the email from the mail server to Internet which is received by the destination mail server, which is then transferred to the designated computer (email receiver) using POP3 (Post Office Protocol v3 the deletes email on servers when receiver downloads email) or IMAP (Internet Message Access Protocol).  
Email Identities and Data: Email senders can be identified by examining the IP address of the network device that sent the email. For an experiment as a personal experience, while using outlook I was able to locate the IP address of the sender and the mail servers it passed through along with all the properties of email and transfer protocol involved in sending and receiving email by clicking in the action button and then the view message source button.
Email Forensics: Paraben’s Email Examiner is one of the exclusive software for email forensics that helps in investigation. It helps email forensics to group evidence by case as well. When a paraben case is created, an investigator is attached that goes through the selected email database and group possible evidences. Email forensics also trace email location by looking at each point through which an email passed. They can work step by step to locate the originating computer through this technique. Since many servers have retention policy, email forensics can investigate through the deleted emails retained by the server.