Title

Email 'Message-IDs' helpful for forensic analysis?

Document Type

Conference Proceeding

Publisher

School of Computer and Information Science, Edith Cowan University

Faculty

Computing, Health and Science

School

Computer and Information Science, Centre for Security Research

Comments

This paper was originally published as: Pasupatheeswaran, S. (2008, December). Email 'Message-IDs' helpful for forensic analysis? In Proceedings of the 6th Australian Digital Forensics Conference, Edith Cowan University, Perth Western Australia. Original article available here

Abstract

Finding the source of spoofed email is a challenging task for forensic investigators. Header of an email has several fields that can be used for investigation. An investigator can easily understand the evidences embedded within most of the header fields of an email, except the message-id field. Therefore, there is a need to understand how message-ids are constructed and what useful information can be recovered from them. The immediate aim of the analysis is to find the message-id construction mechanism of ‘Sendmail’ mail transfer agent (MTA) version 8.14 and how the findings can be used successfully in forensic analysis. Source code of the ‘Sendmail’ MTA is made use of during analysis. This analysis will uncover several information that will help to find email source and validate other email header fields also. The drawbacks in message-id based forensic analysis also discussed here.