
Introduction to Email Forensics, an overview of the course objective and how the course will flow.
A detailed explanation of what email is. What are the different parts of email. What is the role of the forensics examiner in email forensics. What type of crimes are commonly committed with email.
Common tools used in email forensics. Looks at open source vs commercial tools and the advantages and disadvantages of each.
A look at what PST and OST files are, how they are used, where are they located and how they can be used in email investigations .
An eml file is a different type of email file. What are the advantages of this type of file and what can it be used for. What data can it give you?
Walk through of how to examine a PST file and what information you can get for your case with the data it provides. Look at the tool, the data and working a PST file for a forensic case.
Similar to a PST file a MBOX file can hold a collection of email artifacts. What is an MBOX file, what systems use this type of file and how can you use it as an investigator.
Demonstration of acquisition of the an MBOX file from a Gmail account.
Once you have the MBOX file, how do you use it? This lecture demonstrated how to do a forensic analysis of the emails.
How can Webmail be found in operating system artifacts. Where are these artifacts and how they be acquired for investigation.
Can the Internet Service Provider (ISP) provide email. What is the process for obtaining that information. What will be provided.
What are problems that can occur with email. How can the investigator recognize this problems.
What are the parts of the header? How can an investigator read them and what information can be found when reading the header.
How to recognize and analyze and attachment of an email.
Dealing with a deleted email. What are ways to discover and acquire deleted emails from different systems.
How are calendars and tasks stored in different system. How can they be acquired.
Demonstration of acquisition and analysis of a web calendar.
What is phishing, how does it work and what are the different types of phishing.
If email cannot be found on the client OS, can it be found on a Server. What can be found, is there limitation on the amount of time it is there. How can log file help in the investigation?
What is Data Loss Prevention ,how does it work and how could having DLP in place prevent email from leaving the network?
Overview of the topics that we covered in the course and look at where we can go from here on the realm of email forensics.
One of the most important aspects of a computer forensics investigation is email. Who was the suspect talking to, what were they trying to do or what were they trying to hide? Knowing the different types of email system and how to extract them and analyze them can be pivotal to any case.
Email is different than standard computer files, it is a means of communication between two parties to convey information for a purpose. Understanding those communications, where they originated from, who they are really from and what they say is a delicate task. Knowing the fundamental concepts and being about to use the tools to analyze email is crucial to any computer forensics professional.
This course of Email Computer Forensics Fundamentals will provide insight into:
What are the different types of email.
Techniques for extracting/analyzing these different types of emails.
Understanding the email itself in regard to identification, reading the headers and viewing attachments
Where to find deleted mail.
Looking at calendar/task events.
What are the different types of of phishing attempts and how to recognition them.
What is Data Loss Prevention(DLP) software and how can they prevent email attacks.
The course will consist of presentations to explain the concepts of email computer forensics as well as demonstrations of proper collection and preservation of digital evidence.
It is designed for anyone with an interest email computer forensics to get a taste of the real world of examining smart phones and tablets.
As an introductory course it will consist of presentations, hands on lessons and quizs.