Practice area
Email Forensics
Forensic investigation of email messages, the accounts that send and receive them, and the systems that carry and store them.
Types of investigation
- Message authenticity
- Whether a message is genuine or was backdated, whether its contents were changed or attachments were added or removed, and whether it was sent and received when and how it appears to have been.
- Unauthorized access
- Whether someone other than the account holder took over or signed in to a mailbox, when and from where, and what they read, sent, changed, or deleted.
- Business email compromise
- How a fraudulent message, such as a request to change payment details, reached its recipient, whether an account was taken over or a lookalike domain was used, and what the sender did in the mailbox.
- Executive impersonation
- Messages that pose as an executive, e.g., to request a payment or sensitive data, and whether they came from a spoofed address, a lookalike domain, or the executive's own compromised account.
- Man-in-the-middle attacks
- Where an attacker entered an email conversation between two parties, which account, domain, or system was used, and which messages or attachments, such as invoices, were altered or inserted.
- Phishing
- Where a phishing message came from, how it reached the recipient, and whether the account was signed in to or used by someone else afterward.
- CAN-SPAM Act violations
- Technical questions in disputes over commercial email, e.g., who sent or initiated the messages, whether their header and routing information was false or misleading, and what systems were used to send them.
- Email systems
- Who did what and when on an email system after a data breach or data loss, how a mail server or service handled the messages at issue, and what its logs, settings, and retained data can and cannot show.
- Preservation and recovery
- Forensic preservation of mailboxes from cloud and on-premises email services, and recovery of deleted messages and attachments where they survive.
What the analysis answers
- Was this message sent on the date it shows, and was it changed after it was sent?
- Did the message come from the account and the system it appears to come from?
- Who signed in to this account, when, from where, and with what software?
- Were forwarding rules, inbox rules, or delegates added to the mailbox, and by whom?
- Where was an email conversation intercepted, and whose account or domain was used?
- Was the message digitally signed or encrypted, and does the signature verify?
- When was a message received, read, moved, or deleted?
- Can deleted messages or attachments be recovered?
- Does a printout or PDF of an email match the original message? See document forensics.
What is examined
- Transport headers
- Received headers, Message-ID, Date, and the path the message took between servers.
- Signatures and domains
- DKIM and ARC signatures, which can show whether signed parts of a message were changed, and the SPF, DMARC, and DNS records of the domains involved.
- Encryption and digital signatures
- Messages signed or encrypted with S/MIME or OpenPGP, the certificates and keys involved, and what a valid or failed signature shows about the message.
- Message structure
- MIME parts, encodings, boundaries, and the details that reflect the software that composed the message.
- Client metadata
- MAPI properties, the Conversation Index, and other values stored by email clients such as Outlook.
- Sign-in and audit logs
- Sign-in records, mailbox audit logs, message tracking logs, and server event logs, including Outlook on the web and ActiveSync activity, kept by Exchange, Microsoft 365, Google Workspace, and IMAP servers, where they exist and have been retained.
- Mailbox configuration
- Inbox and forwarding rules, delegate permissions, connected apps, and other account settings.
- Mailbox data
- Mailboxes preserved from the server, PST and OST files, and recoverable items such as those in the Exchange Dumpster, including deleted messages carved from these sources.
- Attachments
- The attached files, their internal metadata, and the timestamps that travel with them. See document forensics.
Related writing
- Address
- 840 Apollo Street, Suite 100
El Segundo, CA 90245