Question

You are asked to assume the role of an employee of the DigiFirm Investigation Company. As part of its community outreach effort, the company is preparing a series of short presentations for local middle school students. The topics address how e-mail works and the types of information forensic e-mail investigations attempt to uncover.
To prepare for your presentation, answer the following questions so that you can address them with middle school students during your talk:

1. To trace an e-mail, what part of an e-mail do you examine?
2. Which command(s) would you use?
3. What tools or websites can you use to determine ownership of an e-mail?
4. What tools would you use to explore e-mail on a server?
5. What types of files should you examine on a server?
6. What challenges do you think you would encounter when examining e-mail on a server?

Answer 1

Answer:

1.  To trace an email we need to examine the header part of the email. By examine the header of an email we could extract the sender, subject and other important credentials related to that email.  

2. The command to trace the email id is “whois” command.

 First open the email client and find the IP address of the received email that need to be traced.  The command “whois” IP address gives the registration information of that IP address.

 3.  Reverse address/email search is the procedure used by the experts to find the origin or the ownership of the email.  Rather than tools websites are more use full in the reverse address search.

http://reverse.addresssearch.com, www.iplocation.net, etc. are good to find the ownership of an email.

4. We need to set up mail server to send, receive and to explore various activities associated with an email.  The other related purpose servers like SMTP server, HTTP server , etc are also required to assist large organizations.  The mail server can be a stand-alone computer or a collection of computer and servers.

 5.  The executable files should be examined thoroughly in the server, it can be dangerous malwares.  The examination is mainly done by scanning for malicious words and sender address.  Since many mail providers does not allow executable files to send, so the attackers are using other files also as a carrier of the malwares, so now every emails should be subject to deep examination using some malware scanner.  

6.   By the time of examination the some of the legitimate mails may also come under the suspect list so further check is needed there.  At the same time the attacks can be from legitimate sources also this could be go un-noticed; this should be also a challenge to face in the stage of e-mail examination.