±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36768
New Yesterday: 0 Visitors: 79

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Search found 32 matches

Re: Detecting email that arrived over IMAP, not SMTP

Post Posted: Dec 06, 19 08:10

A couple of ideas that might help with detection:

[quote="TerracottaFaceloth"]
1. As Mallory at no point used SMTP, there are no changes to the original email other than those Mallory chose. That ...
gungora
Topic: Detecting email that arrived over IMAP, not SMTP
Replies: 1
Views: 989
 

Re: Potential Manipulation of Email Name

Post Posted: Nov 16, 19 04:15

[quote="UnallocatedClusters"]
The suspected fraud includes the manual manipulation of the sent emails.[/quote]

If this manual manipulation took place after the email passed through the MTA, I woul ...
gungora
Topic: Potential Manipulation of Email Name
Replies: 4
Views: 1924
 

Re: Alter an email message in your mailbox

Post Posted: Mar 01, 19 18:16

Hi John,

I'm glad you've found it helpful. Thanks for sharing your question with the community!

[quote="jahearne"]
Hi Arman,

Nice work on your article!

https://articles.forensicfocus.com/ ...
gungora
Topic: Alter an email message in your mailbox
Replies: 10
Views: 4842
 

Re: Alter an email message in your mailbox

Post Posted: Jan 19, 19 00:23

[quote="jahearne"]
I didn't know about the server Internal Date Message Attribute, unfortunately, Nuix doesn't pick up on that. In my example (my personal Gmail account), not sure what the UID woul ...
gungora
Topic: Alter an email message in your mailbox
Replies: 10
Views: 4842
 

Re: Alter an email message in your mailbox

Post Posted: Jan 18, 19 05:48

In my experience, altering the message the way you described when connected to Gmail via IMAP would cause Gmail to assign the message a new unique identifier ([url=https://tools.ietf.org/html/rfc3501# ...
gungora
Topic: Alter an email message in your mailbox
Replies: 10
Views: 4842
 

Re: How do you manage evidence storage after phone extractio

Post Posted: Jan 11, 19 20:10

I can imagine that your budget and other practical issues may prevent you from doing things the way you wish—such as getting more software licenses. That said, it sounds like there are a few minor a ...
gungora
Topic: How do you manage evidence storage after phone extractions?
Replies: 6
Views: 3906
 

Re: File Type Help? Recovering Deleted FB Messages

Post Posted: Jan 08, 19 01:54

I am not familiar with Phone Rescue but a good starting point might be to identify the file types you have from their binary signatures. You could use a forensic suite such as X-Ways, or something alo ...
gungora
Topic: File Type Help? Recovering Deleted FB Messages
Replies: 5
Views: 2636
 
Page 1 of 5
Page 1, 2, 3, 4, 5  Next