1. E-Mail and Webmail Forensics

2. Objectives Understand the flow of electronic mail across a network
Explain the difference between resident client programs and webmail
Identify the components of headers
Understand the flow of instant messaging across the network

3. Introduction
has transcended social boundaries and moved from a convenient way to communicate to a corporate requirement. In many cases, incriminating unintentional documentation of people’s activities and attitudes can be found through computer forensics of .
Introduce the chapter.

4. Investigating E-mail Crimes and Violations
Similar to other types of investigations
Goals
Find who is behind the crime
Collect the evidence
Present your findings
Build a case

5. Investigating E-mail Crimes and Violations (continued)
Becoming commonplace
Examples of crimes involving s
Narcotics trafficking
Extortion
Sexual harassment
Child abductions and pornography

6. In Practice: E-Mail in Senate Investigations of Finance Companies
Financial institutions helped Enron manipulate its numbers and mislead investors
proved that banks such as JPMorgan Chase knew very well how Enron was hiding its debt
and poor financial reporting, were able to hide billions in debt from failed deals and projects

7. Importance of E-Mail as Evidence
can be pivotal evidence in a case
Due to its informal nature, it does not always represent corporate policy
Many other cases provide examples of the use of as evidence
Knox v. State of Indiana
Harley v. McCoach
Nardinelli et al. v. Chevron
Ornek 1: messages in which a supervsiro repeatedly asked employee for personal favors served as key evidence in sexual harrassment suit.
Ornek 2: almost similar but also inclides race discrimination case.
Ornek 3: four employees files suit againts the firm claiming that they were sexually harrassed. To show that Chevron’s management allowed a hostile work environment, s containing jokes such as “twenty-five reasons beer is better than women” were introduced as evidence.

8. Working with E-Mail Can be used by prosecutors or defense parties
Two standard methods to send and receive
Client/server applications
Webmail
Begin discussing as it is used in court, and introduce the two standard methods of sending .

9. Working with E-Mail (Cont.)
data flow
User has a client program such as Outlook or Eudora
Client program is configured to work with one or more servers
s sent by client reside on PC
A larger machine runs the server program that communicates with the Internet, where it exchanges data with other servers
3: Thypically they can be found on the server machine as well, but this is not always tru.

10. Working with E-Mail (Cont.)
Sending
User creates on her client
User issues send command
Client moves to Outbox
Server acknowledges client and authenticates account
3. SMTP (Simple Mail Transfer Protocol). Usually uses TCP port number 25.
Client sends to the server
Server sends to destination server
If the client cannot connect with the server, it keeps trying

11. Working with E-Mail (Cont.)
Receiving
User opens client and logs on
User issues receive command
Client contacts server
Server acknowledges, authenticates, and contacts mail box for the account
3- Client contacts server using Post Office Protocol version 3 (POP 3) or Internet Message Access Protocol (IMAP). POP3 assigned TCP port 110, and IMAP is assigned TCP port 143.
Soru: What is the main difference between POP and IMAP when acquiring the ?
Cevap: POP usually downloads all messages to the user’s local computer, placing them in the Inbox of the client and automatically deleting them from the server. With IMAP, the s are also downloaded from the server mailbox and placed in the client Inbox, but they are not deleted from the server. Therefore, with IMAP, a copy is kept on server, and remote accounts can access all of their from any machine.
Mail downloaded to local computer
Messages placed in Inbox to be read
POP deletes messages from server; IMAP retains copy on server

12. Working with E-Mail (Cont.)
Working with resident files
Users are able to work offline with
is stored locally, a great benefit for forensic analysts because the is readily available when the computer is seized
Begin by identifying clients on system
You can also search by file extensions of common clients

13. Working with E-Mail (Cont.)
Client
Extension
Type of File
Eudora
.mbx
Eudora message base
Outlook Express
.dbx
.dgr .
.eml
OE mail database
OE fax page
OE mail message
OE electronic mail
Outlook
.pab
.pst
.wab
Personal address book
Personal folder
Windows address book
Discuss the different types of file extensions, based on the client of the user, you might run into when examining message files.
(Continued)

14. Working with E-Mail (Cont.)
Popular clients:
Outlook Express—installed by default with Windows
Outlook—bundled with Microsoft Office
Eudora—popular free client
1- Can be connected to several servers.

15. Working with Webmail Webmail data flow
User opens a browser, logs in to the webmail interface
Webmail server has already placed mail in Inbox
User uses the compose function followed by the send function to create and send mail
Web client communicates behind the scenes to the webmail server to send the message
No s are stored on the local PC; the webmail provider houses all

16. Working with Webmail (Cont.)
Working with webmail files
Entails a bit more effort to locate files
Temporary files is a good place to start
Useful keywords for webmail programs include:
Yahoo! mail: ShowLetter, ShowFolder Compose, “Yahoo! Mail”
Hotmail: HoTMail, hmhome, getmsg, doattach, compose
Gmail: mail[#]
Gmail uses javascript and therefore may not leave any temporary files.

17. Working with Webmail (Cont.)
Type of Protocol
POP3
IMAP
Webmail
accessible from anywhere No
Yes
Remains stored on server
No (unless included in a backup of server)
Yes, unless POP3 was used too
Dependence on Internet
Moderate
Strong
Special software required
Explain the different types of protocols and how they work with associated servers.

18. Examining E-mail Messages
Access victim’s computer to recover the evidence
Using the victim’s client
Find and copy evidence in the
Guide victim on the phone
Open and copy including headers
Sometimes you will deal with deleted s

19. Examining E-mail Messages (continued)
Copying an message
Before you start an investigation
You need to copy and print the involved in the crime or policy violation
You might also want to forward the message as an attachment to another address
With many GUI programs, you can copy an by dragging it to a storage medium
Or by saving it in a different location

20. Examining E-mail Messages (continued)

21. Examining E-mail Messages (continued)
Understanding headers
The header records information about the sender, receiver, and servers it passes along the way
Most clients show the header in a short form that does not reveal IP addresses
Most programs have an option to show a long form that reveals complete details
Slayt Basi: Content of the can be helpful. However, header is important as well.. Suchs as who created it, what software used to create it, what IP address was used to send it, and the path through the Internet across servers.

22. Examining E-Mails for Evidence (Cont.)
Most common parts of the header are logical addresses of senders and receivers
Logical address is composed of two parts
The mailbox, which comes before sign
The domain or hostname that comes after sign
The mailbox is generally the userid used to log in to the server
The domain is the Internet location of the server that transmits the

23. Examining E-Mails for Evidence (Cont.)
Reviewing headers can offer clues to true origins of the mail and the program used to send it
Common header fields include:
Bcc Cc
Content-Type
Date
From
Message-ID
Received
Subject To
X-Priority
BCC-blind carbon copy. Can be seen only in the sender side, not in the receiver side.
CC-reply all vs. reply
Content type: Deals with non-text items, such as HTML or pictures that are included in the content.
Date: Can we trust this info? No, because the clock on the sending PC may not be set to the correct time.
From: Be careful, this can be spoofed by a spammer or malicious user.
Message-ID: Important. It is a unique identifier assigned to each message by the first server it encounters, usually the sender’s local server or the ISP’s server is webmail is used. This can be forged, so beware of relying solely on this data.
Received: Each server that relays the message puts its IP adress and the date and time the was processes in a received header.

24. Viewing E-mail Headers (continued)
Outlook
Open the Message Options dialog box
Copy headers
Paste them to any text editor
Outlook Express
Open the message Properties dialog box
Select Message Source
Copy and paste the headers to any text editor

25. Viewing E-mail Headers (continued)

26. Viewing E-mail Headers (continued)

28. Viewing E-mail Headers (continued)
Hotmail
Demo!
Apple Mail
Click View from the menu, point to Message, and then click Long Header
Copy and paste headers

29. Viewing E-mail Headers (continued)

30. Viewing E-mail Headers (continued)

31. Viewing E-mail Headers (continued)
Yahoo
Demo

33. Examining Additional E-mail Files
messages are saved on the client side or left at the server
Microsoft Outlook uses .pst file
Most programs also include an electronic address book
In Web-based
Messages are displayed and saved as Web pages in the browser’s cache folders

34. Examining E-Mails for Evidence (Cont.)
Understanding attachments
MIME standard allows for HTML and multimedia images in
Searching for base64 can find attachments in unallocated or slack space
Anonymous r ers
Allow users to remove identifying IP data to maintain privacy
When electronic mail was first introduced it can only handle simple text messages based on 7-bit ASCII coding. Then MIME (Multipurpose Internet Mail extensions) introduced. Attachments are handled by using Base64, which is a binary-to-text encoding scheme.
2. sonu: Use Data carving techniques to pull the significant data from the unallocated space.
Anonymous programs allow users to either remove their identifying information from the header of the or spoof a phony address.

35. Tracing an E-mail Message
Contact the administrator responsible for the sending server
Finding domain name’s point of contact
American Registry for Internet Numbers
Find suspect’s contact information
Verify your findings by checking network logs against addresses

36. Using Network E-mail Logs
Router logs
Record all incoming and outgoing traffic
Have rules to allow or disallow traffic
You can resolve the path a transmitted has taken
Firewall logs
Filter traffic
Verify whether the passed through
You can use any text editor or specialized tools

37. Using Network E-mail Logs (continued)

38. Understanding E-mail Servers
Maintains logs you can examine and use in your investigation
storage
Database
Flat file
Logs

39. Understanding E-mail Servers (continued)
Log information
content
Sending IP address
Receiving and reading date and time
System-specific information
Contact suspect’s network administrator as soon as possible
Servers can recover deleted s
Similar to deletion of files on a hard drive

40. Using Specialized E-mail Forensics Tools
Tools include:
AccessData’s Forensic Toolkit (FTK)
ProDiscover Basic
FINAL
Sawmill-GroupWise
DBXtract
Fookes Aid4Mail and MailBag Assistant
Paraben Examiner
Ontrack Easy Recovery Repair
R-Tools R-Mail

41. Using Specialized E-mail Forensics Tools (continued)
Tools allow you to find:
database files
Personal files
Offline storage files
Log files
Advantage
Do not need to know how servers and clients work

42. Using AccessData FTK to Recover E-mail
Can index data on a disk image or an entire drive for faster data retrieval
Filters and finds files specific to clients and servers

43. Using a Hexadecimal Editor to Carve E-mail Messages
Very few vendors have products for analyzing in systems other than Microsoft
Example: carve messages from Evolution

46. Using a Hexadecimal Editor to Carve E-mail Messages (continued)

47. Using a Hexadecimal Editor to Carve E-mail Messages (continued)

48. Working with Instant Messaging
Most widely used IM applications include:
Yahoo Messenger
Google Talk
Newer versions of IM clients and servers allow the logging of activity
Can be more incriminating than
Instant messaging works similar to a client/server environment.
Chat messages can be acquired from RAM slack or a memory dump.

49. Summary
Electronic mail and instant messages can be important evidence to find
They can provide a more realistic and candid view of a person
Client and server programs are needed for both and IM applications
Webmail does not leave a complete trail on the local computer

50. Summary (Cont.)
It may be necessary to harvest data from a server, in which case you need to consider the following:
Data storage structure being used
Authority to access the data
A realistic plan for time and space needed to house the forensic copy of the data

51. Summary (Cont.)
headers and IM logs can provide additional evidence
Tracing IP addresses may involve searches of international and regional registries responsible for allocating IP addresses

52. Summary (Cont.)
Instant messaging, like , is a client/server-based technology
Due to volume, records may not be kept by providers
If found, can contribute significantly to a case