Email 'Message-IDs' helpful for forensic analysis?
Document Type
Conference Proceeding
Publisher
School of Computer and Information Science, Edith Cowan University
Faculty
Faculty of Computing, Health and Science
School
School of Computer and Information Science / Centre for Security Research
Abstract
Finding the source of spoofed email is a challenging task for forensic investigators. Header of an email has several fields that can be used for investigation. An investigator can easily understand the evidences embedded within most of the header fields of an email, except the message-id field. Therefore, there is a need to understand how message-ids are constructed and what useful information can be recovered from them. The immediate aim of the analysis is to find the message-id construction mechanism of ‘Sendmail’ mail transfer agent (MTA) version 8.14 and how the findings can be used successfully in forensic analysis. Source code of the ‘Sendmail’ MTA is made use of during analysis. This analysis will uncover several information that will help to find email source and validate other email header fields also. The drawbacks in message-id based forensic analysis also discussed here.
DOI
10.4225/75/57b2735e40cbe
Access Rights
free_to_read
Comments
Pasupatheeswaran, S. (2008, December). Email 'Message-IDs' helpful for forensic analysis? In Proceedings of the 6th Australian Digital Forensics Conference, Edith Cowan University, Perth Western Australia. Available here