August 17, 2021
Trusted Timestamping (RFC 3161) in Digital Forensics
Trusted timestamping as defined in RFC 3161 makes its way into my digital forensics workflow…
March 23, 2020
Dates in Hiding Part 2 — Gmail MIME Boundary Timestamps
This post on Gmail MIME boundary timestamps is an update to my previous Dates in…
December 12, 2019
Google Takeout and Vault in Email Forensics
Introduction Google Takeout and Google Vault are commonly used to export email evidence for digital…
September 17, 2019
Dates in Hiding—Uncovering Timestamps in Forensic Email Examination
One of my favorite data points when forensically examining emails is hidden timestamps. These timestamps…
May 16, 2019
Leveraging DKIM in Email Forensics
My last article was about using the Content-Length header field in email forensics. While the…
March 26, 2019
Using the Content-Length Header Field in Email Forensics
As forensic examiners, we often have to analyze emails in isolation without the benefit of…
January 24, 2019
Forensic Examination of Manipulated Email in Gmail
I came across an interesting post on Forensic Focus. The poster was asking about how one can detect manipulation…