±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 0
Overall: 27614
Visitors: 43

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Forwarded email authentication

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Forwarded email authentication

Post Posted: Thu Feb 14, 2013 9:10 am

Hello Everyone,

Is there a way to check the veracity of the content of a forwarded email?

Let's say I send an email to my boss asking for green light for buying a TD3. He replies back to me says "NO" and I forward that email to seller changing the content from my boss email to "Yes".

I have done some testing looking at headers but there is no information there that specifies the email has been altered. Moreover, the thread index is the same.

The only thing I can think about is to put the emails with same thread index together and check the differences with a tool.

Do you have any experience, thoughts or ideas about this?

Thanks in advance.  

israellesg
Newbie
 
 
  

Re: Forwarded email authentication

Post Posted: Thu Feb 14, 2013 11:24 am

In most cases there isn't a means to check within the message: as far as your email client is concerned the body of the original message usually just becomes part of the body of your message when you forward it, so you can edit it as you please (although depending on the settings of your mail client it may do helpful stuff like marking comments you make on the forwarded message with your name).

As you suggest, the best thing would be to identify mails in the same thread and from different sources (e.g. your computer, your boss' computer, the mail server) and compare the content. I did this myself on a case where it was alleged that certain copies of particular emails had been falsified.  

pragmatopian
Senior Member
 
 
  

Re: Forwarded email authentication

Post Posted: Thu Feb 14, 2013 12:18 pm

- pragmatopian
In most cases there isn't a means to check within the message: as far as your email client is concerned the body of the original message usually just becomes part of the body of your message when you forward it, so you can edit it as you please (although depending on the settings of your mail client it may do helpful stuff like marking comments you make on the forwarded message with your name).

As you suggest, the best thing would be to identify mails in the same thread and from different sources (e.g. your computer, your boss' computer, the mail server) and compare the content. I did this myself on a case where it was alleged that certain copies of particular emails had been falsified.


That's what I was thinking Smile

Thanks for your answer.  

israellesg
Newbie
 
 
  

Re: Forwarded email authentication

Post Posted: Thu Feb 14, 2013 1:23 pm


joachimm
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 1