December 12, 2019
Google Takeout and Vault in Email Forensics
Introduction Google Takeout and Google Vault are commonly used to export email evidence for digital…
Read More
September 17, 2019
Dates in Hiding—Uncovering Timestamps in Forensic Email Examination
One of my favorite data points when forensically examining emails is hidden timestamps. These timestamps…
Read More
May 16, 2019
Leveraging DKIM in Email Forensics
My last article was about using the Content-Length header field in email forensics. While the…
Read More
March 26, 2019
Using the Content-Length Header Field in Email Forensics
As forensic examiners, we often have to analyze emails in isolation without the benefit of…
Read More
January 24, 2019
Forensic Examination of Manipulated Email in Gmail
I came across an interesting post on Forensic Focus. The poster was asking about how one can detect manipulation…
June 25, 2018
Using IMAP Internal Date for Forensic Email Authentication
Internal Date is an IMAP Message Attribute that indicates the internal date and time of…
Read More
April 25, 2018
Searching & Filtering Emails when Forensically Collecting Mailboxes
When mailboxes are forensically preserved for eDiscovery or digital forensic investigations, their contents are almost…
Read More
March 28, 2018
7 Reasons Not to Use Outlook to Forensically Preserve Emails
Outlook is a very capable email client and is widely available in business settings. Perhaps…
Read More
January 11, 2018
Forensically Collecting Emails — 5 Things to Know
There is no doubt that email evidence plays a big role in digital forensics and…
Read More
September 1, 2017
Recovering Removed Email Attachments — Outlook Email Forensics
I came across a question by user flytnx about removed email attachments on Forensic Focus. The…
Read More