How can I find out ...
 
Notifications
Clear all

How can I find out every single email address that was used on a computer?

pippin
(@pippin)
New Member

This is for a Mac. Thanks.

Quote
Topic starter Posted : 22/07/2021 5:48 pm
kgbuquerin
(@kgbuquerin)
New Member

Hi,

it depends on your goal. If you want to find out every single email address (even within files), I would suggest to use YARA. You can scan every file on the computer and your rule will notify you, if there is any hit. Here is an example of CEO fraud rules that could be used to suite this use-case: https://support.knowbe4.com/hc/en-us/articles/360019622314-YARA-Rule-Examples

If you want to find all used email addresses, I would suggest to review all information/log you can obtain from mailing software. In addition, mailing software uses predefined paths, where emails are stored.

 

Cheers,

kgbuquerin

ReplyQuote
Posted : 23/07/2021 7:16 am
JerryW
(@jerryw)
Member

If you have a forensic image and literally only want a list of email addresses, you could try Bulk Extractor. If you want to perform some additional analysis to determine 'that was used', then the most suitable tool will depend on the task required and your budget.

ReplyQuote
Posted : 23/07/2021 9:42 am
Share: