Hi John,

I'm glad you've found it helpful. Thanks for sharing your question with the community!

[quote="jahearne"]
Hi Arman,

Nice work on your article!

https://articles.forensicfocus.com/ ...

[quote="jahearne"]
I didn't know about the server Internal Date Message Attribute, unfortunately, Nuix doesn't pick up on that. In my example (my personal Gmail account), not sure what the UID woul ...

In my experience, altering the message the way you described when connected to Gmail via IMAP would cause Gmail to assign the message a new unique identifier ([url=https://tools.ietf.org/html/rfc3501# ...

I can imagine that your budget and other practical issues may prevent you from doing things the way you wish—such as getting more software licenses. That said, it sounds like there are a few minor a ...

I am not familiar with Phone Rescue but a good starting point might be to identify the file types you have from their binary signatures. You could use a forensic suite such as X-Ways, or something alo ...

I recommend taking a look at SWGDE:

[url=https://www.swgde.org/documents]https://www.swgde.org/documents

[quote="SilesianMan"]Dear all,

I am writing some internal digital forensic procedures ...

I would start by getting a history list from Gmail API:

https://developers.google.com/gmail/api/v1/reference/users/history/list

In my experience, the history list shows the original labels of th ...