1. 1 Email and Internet Evidence Mark Pollitt Associate Professor, Engineering Technology

2. Web 1.0 Technologies Technologies – Email – Web – Skype – IM Web 1.0 because: – Static content – Application standards – Client based

3. Forensics on Web 1.0 Technologies Focus on two elements: – The application – The data Looking for: – The content – The connections

4. Applications Developers need to build three things into communications applications: – User interface – Data processing/storage – Communications protocols Multiple Applications can share a common protocol – Outlook, Thunderbird, Zimbra – Hotmail, Yahoo, Gmail

5. Web Browsers All share HTML Some support other technologies: – Active X, Flash, XML, etc. All store a cache of recent files and a history – Most store those differently – Usually, it takes a specific tool to look at browser histories Documenting both Internet history and reconstructing web pages is important evidence

6. Doing Browser Forensics Know how the browser stores data Know the location of the data Have a tool that can read that data Great resources: http://www.symantec.com/connect/articles/web- browser-forensics-part-1 http://www.symantec.com/connect/articles/web- browser-forensics-part-2

7. Email Very simple in concept: – Client/Server – SMTP protocol Two basic interfaces: – Web mail (Hotmail, Yahoo, Gmail) – Client based (POP, IMAP, SMTP) – Some support both Features vary by client

8. Email Clients Like Browsers, they share some features: – Communications protocols (POP, IMAP, SMTP, etc.) – User Interface – Storage – usually some form of database

9. Internet History Browsers Nirsoft – IEHistory View/Mozilla Cache View Security Exploded – Browser History Spy* Sqlite Viewer - Firefox

10. Email Investigations Client Software – Outlook – Thunderbird – Zimbra Forensic Suites – EnCase – FTK Webmail – Use browser forensics

11. Thank You for your Attention!