Web based email cache

Hi Tod,

I'm very new to the field, I just started the CCE course online, but…

http//www.browserforensics.org/ seems like a great site. I took a very quick look at the presentation by Peter Hewitt and Manuel Pelaez, but I'm pretty sure it has some useful information that you can use.

What you are looking for is to "carve" data from a suspect machine for "webmail artifacts" you might want to do some searching on the forum and Intertubes for those terms.

There are some good software packages out there as well. Commercially, you may want to have a look at www.jadsoftware.com and Internet Evidence Finder. I have used it with success. EnCase has some prebuilt scripts. But all in all you should take the time to learn how these tools do what they do.