Comments on: Email Forensics

Question: Email Forensics

about_time — Tue, 12 Feb 2008 14:16:47 -0800

Where can I find information about email headers? I'd like to learn how to look at an email header and answer such questions as "Was this email forged?" and "What is the IP of the sender and the sender's ISP?"

Thanks for your help. Examples of email header parsing would be welcome as well.

By: hubris

hubris — Tue, 12 Feb 2008 14:21:52 -0800

It's pretty much just experience; taking an e-mail and reading through it, then looking up stuff you don't know.

But try this site, it's a pretty good intro: http://www.uic.edu/depts/accc/newsletter/adn29/headers.html

By: rokusan

rokusan — Tue, 12 Feb 2008 14:50:17 -0800

Also, this.

Note that each e-mail client (sending program like Outlook) and server (sending and receiving) add their own twists and turns. Spam and virus filters also add another "layer" of fingerprint info.

By: elle.jeezy

elle.jeezy — Tue, 12 Feb 2008 15:18:02 -0800

Sam Spade is a useful tool for investigating the bits and pieces of headers.

By: winston

winston — Tue, 12 Feb 2008 15:27:49 -0800

The main thing is to follow the "received" headers. Each server adds a new header to the top of the list. So a proper email should look like:

Received from C by D;
Received from B by C;
Received from A by B;

Each time the server named after "from" should be the server named after "by" on the line below.

When headers have been forged, you will see something like:

Received from P by Q;
Received from O by P;
Received from M by N;

There is a break in the logic. P is the actual origin of the message and all headers below "Received from O by P;" are forged.

By: yclipse

yclipse — Tue, 12 Feb 2008 18:29:57 -0800

You mean O is the origin, yes?

By: DevilsAdvocate

DevilsAdvocate — Tue, 12 Feb 2008 18:57:32 -0800

alt.spam FAQ: Tracing an e-mail message

By: winston

winston — Wed, 13 Feb 2008 11:24:47 -0800

Thanks, yclipse. You are correct.

By: winston

winston — Wed, 13 Feb 2008 11:27:53 -0800

Though, now that I think of it, we don't know for certain that the "received by O" part is correct, just that it was actually P who added that header

By: winston

winston — Wed, 13 Feb 2008 11:28:27 -0800

from O. I'll stop now