was successfully added to your cart.
Category

Articles

Articles
December 12, 2019

Google Takeout and Vault in Email Forensics

Introduction Google Takeout and Google Vault are commonly used to export email evidence for digital…
Read More
forensic timestamps
Articles
September 17, 2019

Dates in Hiding—Uncovering Timestamps in Forensic Email Examination

One of my favorite data points when forensically examining emails is hidden timestamps. These timestamps…
Read More
Articles
May 16, 2019

Leveraging DKIM in Email Forensics

My last article was about using the Content-Length header field in email forensics. While the…
Read More
Articles
March 26, 2019

Using the Content-Length Header Field in Email Forensics

As forensic examiners, we often have to analyze emails in isolation without the benefit of…
Read More
Gmail message manipulation
Articles
January 24, 2019

Forensic Examination of Manipulated Email in Gmail

I came across an interesting post on Forensic Focus. The poster was asking about how one can detect manipulation…

Read More
Forensic Email Authentication
Articles
June 25, 2018

Using IMAP Internal Date for Forensic Email Authentication

Internal Date is an IMAP Message Attribute that indicates the internal date and time of…
Read More
search and filtering emails
Articles
April 25, 2018

Searching & Filtering Emails when Forensically Collecting Mailboxes

When mailboxes are forensically preserved for eDiscovery or digital forensic investigations, their contents are almost…
Read More
Articles
March 28, 2018

7 Reasons Not to Use Outlook to Forensically Preserve Emails

Outlook is a very capable email client and is widely available in business settings. Perhaps…
Read More
forensically collecting emails
Articles
January 11, 2018

Forensically Collecting Emails — 5 Things to Know

There is no doubt that email evidence plays a big role in digital forensics and…
Read More
Removed email attachments
Articles
September 1, 2017

Recovering Removed Email Attachments — Outlook Email Forensics

I came across a question by user flytnx about removed email attachments on Forensic Focus. The…
Read More