1. E-Mail Investigations
[ 10 week ]
Investigations
2015 second semester

2. Learning Goal
We will study how to trace, recover, and analyze messages by using forensics tools designed for investigating and general-purpose tools, such as wireshark, base64 data decoder and HxD.

3. Learing Objectives After learning this class, you will be able to:
• explain the role of in investigations.
• describe client and server roles in .
• describe tasks in investigating crimes and violations.
• explain the use of server logs.
• describe some available computer forensics tools.

4. Today’s Activity Step1: Download the class materials at
lecture board at professor’s
blog(
Step2: Solve the puzzle#2.
Step3: Complete your worksheet include
the answer’s of puzzle#2.
Step4: Upload your worksheet on the
Free board at Professor’s blog.

5. Keywords SMTP protocol 587 MIME Data encoding especially Base64
File signature of .docx

6. E-Mail Investigations
evidence has become an important part of many computing investigations, so computer forensics investigators must know how is processed to collect this essential evidence.

7. E-Mail Investigations
Investigating crimes or policy violations involving is similar to investigating other types of computer abuse[남용] and crimes.
Your goal is to find out who’s behind the crime or policy violation, collect the evidence, and present your findings to build a case for prosecution[고발] or arbitration[중재].

8. Puzzle#2 Senario
After being released on bail, Ann Dercover disappears! Fortunately, investigators were carefully monitoring her network activity before she skipped town.
“We believe Ann may have communicated with her secret lover, Mr. X, before she left,” says the police chief. “The packet capture may contain clues to her whereabouts.”
You are the forensic investigator. Your mission is to figure out what Ann ed, where she went, and recover evidence including:

10. Puzzle#2 mission
1. What is Ann’s address? 2. What is Ann’s password? 3. What is Ann’s secret lover’s address? 4. What two items did Ann tell her secret lover to bring? 5. What is the NAME of the attachment Ann sent to her secret lover? 6. What is the MD5sum of the attachment Ann sent to her secret lover? 7. In what CITY and COUNTRY is their rendez-vous point? 8. What is the MD5sum of the image embedded in the document?

11. Final Output

12. Activity

13. Nothing is final until it's final. , Don't give up so easily
Nothing is final until it's final!!, Don't give up so easily. Call me at any time if you need help. I'll help you can do it.