How can I find out ...
 
Notifications
Clear all

How can I find out every single email address that was used on a computer?

3 Posts
3 Users
0 Reactions
1,726 Views
(@pippin)
Active Member
Joined: 6 years ago
Posts: 19
Topic starter  

This is for a Mac. Thanks.


   
Quote
kgbuquerin
(@kgbuquerin)
New Member
Joined: 4 years ago
Posts: 2
 

Hi,

it depends on your goal. If you want to find out every single email address (even within files), I would suggest to use YARA. You can scan every file on the computer and your rule will notify you, if there is any hit. Here is an example of CEO fraud rules that could be used to suite this use-case: https://support.knowbe4.com/hc/en-us/articles/360019622314-YARA-Rule-Examples

If you want to find all used email addresses, I would suggest to review all information/log you can obtain from mailing software. In addition, mailing software uses predefined paths, where emails are stored.

 

Cheers,

kgbuquerin


   
ReplyQuote
(@jerryw)
Trusted Member
Joined: 17 years ago
Posts: 56
 

If you have a forensic image and literally only want a list of email addresses, you could try Bulk Extractor. If you want to perform some additional analysis to determine 'that was used', then the most suitable tool will depend on the task required and your budget.


   
ReplyQuote
Share: