Email and Internet Evidence

1. Email and Internet Evidence Mark Pollitt Associate Professor, Engineering Technology

2. Web 1.0 Technologies • Technologies • Email • Web • Skype • IM • Web 1.0 because: • Static content • Application standards • Client based

3. Forensics on Web 1.0 Technologies • Focus on two elements: • The application • The data • Looking for: • The content • The connections

4. Applications • Developers need to build three things into communications applications: • User interface • Data processing/storage • Communications protocols • Multiple Applications can share a common protocol • Outlook, Thunderbird, Zimbra • Hotmail, Yahoo, Gmail

5. Web Browsers • All share HTML • Some support other technologies: • Active X, Flash, XML, etc. • All store a cache of recent files and a history • Most store those differently • Usually, it takes a specific tool to look at browser histories • Documenting both Internet history and reconstructing web pages is important evidence

6. Doing Browser Forensics • Know how the browser stores data • Know the location of the data • Have a tool that can read that data • Great resources: http://www.symantec.com/connect/articles/web-browser-forensics-part-1 http://www.symantec.com/connect/articles/web-browser-forensics-part-2

7. Email • Very simple in concept: • Client/Server • SMTP protocol • Two basic interfaces: • Web mail (Hotmail, Yahoo, Gmail) • Client based (POP, IMAP, SMTP) • Some support both • Features vary by client

8. Email Clients • Like Browsers, they share some features: • Communications protocols (POP, IMAP, SMTP, etc.) • User Interface • Storage – usually some form of database

9. Internet History Browsers • Nirsoft – IEHistory View/Mozilla Cache View • Security Exploded – Browser History Spy* • Sqlite Viewer - Firefox

10. Email Investigations • Client Software • Outlook • Thunderbird • Zimbra • Forensic Suites • EnCase • FTK • Webmail • Use browser forensics

11. Thank You for your Attention!