Title: 4. Understanding E-mail Servers
Course: IN 2005 Digital Forensics > Section: Module 12: Chapter 12 -E-mail Investigations

Understanding E-mail Servers

1. E-mail servers store e-mail messages using either a database or a flat file system.
2. The use of log files on a server.  Some systems have logs enabled by default; others need the administrator to turn them on.  Logs can work on continuous and circular mode.  Circular mode saves valuable server storage space but overwrites information that cannot be recovered during an investigation.
3. See Figure 12-14 to describe some of the information recorded in a log, including:
  - E-mail content
  - Sending IP address
  - Receiving and reading date and time
  - System-specific information
4. To recover deleted e-mails from a server.  The process is similar to recovering deleted files on a hard drive.

Examining UNIX E-mail Server Logs

1. The main log files on UNIX systems and how they relate to e-mail services.  Log files include files such as:
  - /etc/sendmail.cf
  - /etc/syslog.conf
  - /var/log/maillo

Examining Microsoft E-mail Server Logs

1. Exchange is a database e-mail server based on Microsoft Extensible Storage Engine (ESE).  Its Information Store area comprises two main file types:
  - Database files .edb for storing MAPI information
  - Database files .smt for storing non-MAPI information
2. See Figures 12-18 through 12-20 that describe the main log files used by Microsoft Exchange Server including:
  - Transaction logs
  - Checkpoints
  - Temporary files
  - E-mail communication logs
  - Tracking logs
  - Troubleshooting or diagnostic logs

Examining Novell GroupWise E-mail Logs

1. Novell’s GroupWise has up to 25 databases for users’ e-mails stored in the Ofuser directory object.
2. Two methods of organizing mailboxes:
  - Permanent index files
  - QuickFinder