Title: 3. Investigating E-mail Crimes and Violations
Course: IN 2005 Digital Forensics > Section: Module 12: Chapter 12 -E-mail Investigations

Investigating E-mail Crimes and Violations

1. Investigating crimes or policy violations involving e-mail is similar to investigating other types of computer abuse and crimes.
2. The goals of e-mail crimes and violations investigations, including:
  - Find who is behind the crime
  - Collect the evidence
  - Present your findings
  - Build a case
3. What is considered a crime or policy violation involving e-mail depends on the city, state or country in which the e-mail originated.
4. A list of some examples of crimes involving e-mails, such as:
  - Narcotics trafficking
  - Extortion
  - Sexual harassment
  - Stalking
  - Fraud
  - Child abduction
  - Terrorism
  - Child pornography

Viewing E-mail Headers

1. See Figures 12-3 through 12-11 to show how to view e-mail headers using different kinds of clients including GUI, command-line and Web-based clients such as:
  - Microsoft Outlook
  - Microsoft Outlook Express
  - Novell Evolution
  - Pine
  - ELM
  - AOL
  - Hotmail
  - Apple Mail
  - Yahoo!

Examining E-mail Headers

1. E-mail headers contain useful information for an investigation. See 12-12 that explains how to analyze header content line by line.  Information included on e-mail headers includes:
  - Return path
  - Recipient’s e-mail address
  - Type of sending e-mail service
  - IP address of sending server
  - Name of the e-mail server
  - Unique message number
  - Date and time e-mail was sent
  - Attachment files information

Examining Additional E-mail Files

1. Depending on settings, e-mails are saved at the client’s side or left on the server.  How to deal with files related to different e-mail clients.  For example, Microsoft Outlook saves e-mails on .pst and .ost files.  Web-based e-mails are like any other Web page.  Check History, Cookies, Cache and temporary files and folders for evidence.
2. Another source of valuable information is the personal address book.

Tracing an E-mail Message

1. To track down a suspect using the information acquired so far from an e-mail . Use the following sites to find the contact point of the originating domain name:
  - www.arin.net
  - www.internic.com
  - www.freeality.com
  - www.google.com
2. These sites, you can find the suspect’s e-mail address and contact information.  Do not forget to verify your finding with network logs since the suspect might have posted fake information.

Using Network Logs Related to E-mail

1. Information contained on network router and firewall logs can help an investigator track down a suspect. See Figure 12-13.