March 26, 2019
Using the Content-Length Header Field in Email Forensics
As forensic examiners, we often have to analyze emails in isolation without the benefit of…
Read More
January 24, 2019
Forensic Examination of Manipulated Email in Gmail
I came across an interesting post on Forensic Focus. The poster was asking about how one can detect manipulation…
June 25, 2018
Using IMAP Internal Date for Forensic Email Authentication
Internal Date is an IMAP Message Attribute that indicates the internal date and time of…
Read More
April 25, 2018
Searching & Filtering Emails when Forensically Collecting Mailboxes
When mailboxes are forensically preserved for eDiscovery or digital forensic investigations, their contents are almost…
Read More
March 28, 2018
7 Reasons Not to Use Outlook to Forensically Preserve Emails
Outlook is a very capable email client and is widely available in business settings. Perhaps…
Read More
January 11, 2018
Forensically Collecting Emails — 5 Things to Know
There is no doubt that email evidence plays a big role in digital forensics and…
Read More
September 1, 2017
Recovering Removed Email Attachments — Outlook Email Forensics
I came across a question by user flytnx about removed email attachments on Forensic Focus. The…
Read More
July 10, 2017
MX Records in Digital Forensics and eDiscovery
There is no denying that MX records are an important part of digital life. They…
Read More
June 20, 2017
Gmail Forensic Preservation and Overlapping Labels
I have been asked to forensically preserve hosted mailboxes countless times. I didn't keep a tally,…
Read More
June 12, 2017
Native File Format for Preservation of Cloud Emails
Definition of Native File Format Native file format is defined as the format in which…
Read More