±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35131
New Yesterday: 2 Visitors: 191

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Alter an email message in your mailbox

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2 
  

Re: Alter an email message in your mailbox

Post Posted: Fri Jan 18, 2019 5:23 pm

- jahearne

I didn't know about the server Internal Date Message Attribute, unfortunately, Nuix doesn't pick up on that. In my example (my personal Gmail account), not sure what the UID would be. I have "X-Google-Smtp-Source" and X-Received with SMTP id. The SMTP id has an epoch date in it, but the both match with the original message and the one I altered. When I'm in Gmail and select Show Original, I don't get the Internal Date Message Attribute or UID, do I?


Hi John,

That's right; selecting "Show Original" in Gmail wouldn't show you the UID of the message. UID is an IMAP concept, and you can capture it with other server-side metadata during preservation—provided that your tool supports it. You can also query it by directly talking to the IMAP server. In one of our webinars, I was connecting to an IMAP server and issuing some commands manually to show UIDs and internal dates—I will dig it up and PM you the link.

When analyzing an altered message, you would want to be looking at the message along with its neighbors to see if their UIDs are in sequence when they are in chronological order. You could do this by selecting a folder (i.e., EXAMINE) and then running an IMAP SEARCH command to narrow the contents down.
_________________
Arman Gungor

Metaspike
Developers of Forensic Email Collector
www.metaspike.com 

gungora
Member
 
 
  

Re: Alter an email message in your mailbox

Post Posted: Fri Jan 18, 2019 6:17 pm

- watcher
Let me start by saying I'm confused.


You should have seen me when I first started this case! Couldn't see straight for half a day... jk.  

jahearne
Member
 
 

Page 2 of 2
Go to page Previous  1, 2