March 23, 2020
Dates in Hiding Part 2—Gmail MIME Boundary Timestamps
This post on Gmail MIME boundary timestamps is an update to my previous Dates in…
December 12, 2019
Google Takeout and Vault in Email Forensics
Introduction Google Takeout and Google Vault are commonly used to export email evidence for digital…
September 17, 2019
Dates in Hiding—Uncovering Timestamps in Forensic Email Examination
One of my favorite data points when forensically examining emails is hidden timestamps. These timestamps…
May 16, 2019
Leveraging DKIM in Email Forensics
My last article was about using the Content-Length header field in email forensics. While the…
March 26, 2019
Using the Content-Length Header Field in Email Forensics
As forensic examiners, we often have to analyze emails in isolation without the benefit of…
January 24, 2019
Forensic Examination of Manipulated Email in Gmail
I came across an interesting post on Forensic Focus. The poster was asking about how one can detect manipulation…
March 28, 2018
7 Reasons Not to Use Outlook to Forensically Preserve Emails
Outlook is a very capable email client and is widely available in business settings. Perhaps…
January 11, 2018
Forensically Collecting Emails — 5 Things to Know
There is no doubt that email evidence plays a big role in digital forensics and…