Technology Corner: Analysing E-Mail Headers for Forensic Investigation

Abstract

Electronic Mail (E-Mail), which is one of the most widely used applications of Internet, has become a global communication infrastructure service. However, security loopholes in it enable cybercriminals to misuse it by forging its headers or by sending it anonymously for illegitimate purposes, leading to e-mail forgeries. E-mail messages include transit handling envelope and trace information in the form of structured fields which are not stripped after messages are delivered, leaving a detailed record of e-mail transactions. A detailed header analysis can be used to map the networks traversed by messages, including information on the messaging software and patching policies of clients and gateways, etc. Cyber forensic e-mail analysis is employed to collect credible evidence to bring criminals to justice. This paper projects the need for e-mail forensic investigation and lists various methods and tools used for its realization. A detailed header analysis of a multiple tactic spoofed e-mail message is carried out in this paper. It also discusses various possibilities for detection of spoofed headers and identification of its originator. Further, difficulties that may be faced by investigators during forensic investigation of an e-mail message have been discussed along with their possible solutions.

Investigasi Email Spoofing dengan Metode Digital Forensics Research Workshop (DFRWS)

“…Penelitian email spoofing juga dilakukan oleh [5], hasil dari penelitiannya adalah "Analisis dilakukan pada isi pesan email untuk menentukan legitimasinya". Pembeda penelitiannya adalah penelitian oleh [5] melakukan analisis header email namun tanpa mengetahui asal usul email dikirimkan dan tidak membahas cara kerja email spoofing, hal itu memungkinkan analisis email spoofing tidak dapat dengan mudah dipahami oleh semua orang, sedangkan pada penelitian ini dilakukan simulasi pengiriman email spoofing dengan tujuan mempermudah pemahaman tentang email spoofing.…”

A Game Theoretic Framework for E-Mail Detection and Forgery Analysis

“…, compute the defection rate P according to the (2) and (3),and compute the rewards of detector and forger according to the (4) and (5) iv).…”

“…M.T Banday and Hong Guo et al. studied the working principle of an email, discussed the construction mechanism of keywords that commonly used in the header field, and applied the analysis to email forensic [2,3]. Based on the email header information, Preeti and Surekha et al provided an algorithm to identify the data, time, and address spoofing [4,5].…”

Towards Comprehensive and Collaborative Forensics on Email Evidence

“…From this metadata alone, an examiner can detect communication flows and evidence tampering, among other things. As shown by Banday in [12], the email headers are a valuable source of information in a forensic investigation involving email.…”

“…Furthermore, normally mbox stores attachments in some form of directory structure related to their messages so that attachment analysis could be started as part of an automated process, separate from the email data. Finally, using mbox is useful even when processing the common PST format as tools from libPST 12 provide the conversion. Finally, we assert that mbox is valid for use as a forensic copy format as it is "output readable by sight, shown to reflect the data accurately" and thus "is an original" [2, pg.…”