JITA 8(2018) 2:64-74 LJUBOMIR LAZIĆ:

E-MAIL FORENSICS: TECHNIQUES AND TOOLS FOR

FORENSICINVESTIGATION OF ONE COURT CASE
Ljubomir Lazić
Faculty Of Information Technology, Metropolitan University, Belgrade [email protected]

Case study
DOI: 10.7251/JIT1802064L UDC: 004.42:004.738.5

Abstract: E-mail has emerged as the most important application on the Internet for communication of messages, delivery of
documents and carrying out transactions and is used not only from computers, but many other electronic gadgets such as mobile
phones. This paper is an attempt to illustrate e-mail architecture from forensics perspective. Also, this paper projects the need for
e-mail forensic investigation and lists various methods and tools used for its realization. A detailed header analysis of a multiple
tactic spoofed e-mail message is carried out in this paper. It also discusses various possibilities for detection of spoofed headers and
identi ication of its originator. Furthermore, dif iculties that may be faced by investigators during forensic investigation of an e-mail
message have been discussed along with their possible solutions. Our focus is on email header analysis phase offered by the tools.
We examine the capability of a particular tools such as EmailTrackerPro and aid4mail in action. The paper describes the court case
of cyber crime, the so-called identity theft in Internet communication via electronic mail by two business entities. Identity theft of
e-mail addresses and false communications with a foreign company was carried out in order to indicate that a cash transaction of
around EUR 100,000 was paid to the account of NN attackers and not to the account in the domestic Serbian bank.
Keywords: E-mail forensic, header analysis, E-mail message as evidence.

INTRODUCTION bene it of using web-based email clients is that they

can be accessed from anywhere in the world, using
Modern time communication is impossible without Username and Password. One of their disadvantages is
emails. In the ield of business communication, emails the users not knowing where their data is being stored.
are considered as its integral part. At the same time, b) Desktop-based Email Clients: Desktop-based
emails are also used by criminals [1,2,4]. In digital fo- email clients are the opposite of web-based cli-
rensics, emails are considered as evidence and Email ents. Outlook, Thunderbird, Mail Bird are some ex-
Header Analysis has become important to collect evi- amples of desktop-based email clients. All data of
dence during forensics process [2,3]. Email clients are desktop-based web browser is stored in the system
computer programs that allow users to send and re- of its users. Thus, users do not have to worry about
ceive emails. Over time, different types of email clients data security. The same point can be considered as
have been invented for the convenience of email users. a disadvantage in some cases. This is especially the
We will discuss different types of email clients now. case when it is used in criminal activities, and the
Broadly, email clients are divided into two types based evidence cannot be collected from the server [3,5].
on email saving location. These are web-based email E-mail messages include transit handling envelope
clients and desktop-based email clients. and trace information in the form of structured
a) Web-based Email Clients: Web-based email cli- ields which are not stripped after messages are de-
ents save all their data to their web server. Some web- livered, leaving a detailed record of e-mail transac-
based clients are Gmail, Yahoo Mail, Hotmail, etc. The tions. A detailed header analysis can be used to map

64 Journal of Information Technology and Applications www.jita-au.com

E-MAIL FORENSICS: TECHNIQUES AND TOOLS FOR FORENSICINVESTIGATION OF ONE COURT CASE JITA 8(2018) 2:64-74

the networks traversed by messages, including the server computers and receiver’s client and server
information on the messaging software and patch- computers with required software and services in-
ing policies of clients and gateways, etc. Over a pe- stalled on each. Besides these, it uses various systems
riod of year’s e-mail protocols have been secured and services of the Internet. The sending and receiv-
through several security extensions and producers, ing servers are always connected to the Internet but
however, cybercriminals continue to misuse it for the sender’s and receiver’s client connects to the In-
illegitimate purposes by sending spam, phishing e- ternet as and when required [2,3]. E-mail is a highly
mails, distributing child pornography, and hate e- distributed service that involves several actors which
mails besides propagating viruses, worms, hoaxes play different roles to accomplish end-to-end e-mail
and Trojan horses. Further, Internet infrastructure exchange [2]. These actors fall under three groups,
misuse through denial of service, waste of storage namely User Actors, Message Handling Service (MHS)
space and computational resources are costing ev- Actors and ADministrative Management Domain
ery Internet user directly or indirectly. (ADMD) Actors. User Actors are Authors, Recipients,
E-mail forensic analysis is used to study the source Return Handlers and Mediators that represent peo-
and content of e-mail message as evidence, identify- ple, organizations or processes that serve as sources
ing the actual sender, recipient and date and time it or sinks of messages. They can generate, modify or
was sent, etc. to collect credible evidence to bring look at the whole message. Message Handling Ser-
criminals to justice [1-5]. This paper is an attempt to vice (MHS) Actors are Originators, Relays, Gateways
illustrate e-mail architecture from forensics perspec- and Receivers which are responsible for end-to-end
tive. It describes roles and responsibilities of differ- transfer of messages. These Actors can generate,
ent e-mail actors and components, itemizes meta- modify or look at only transfer data in the message.
data contained in e-mail headers, and lists protocols ADministrative Management Domain (ADMD) Actors
and ports used in it. It further describes various tools are Edges, Consumers and Transits which are asso-
and techniques currently employed to carry out fo- ciated with different organizations and have their
rensic investigation of an e-mail message. own administrative authority, operating policies and
This paper projects the need for e-mail forensic trust-based decision making [2].
investigation and lists various methods and tools E-mail system is an integration of several hard-
used for its realization. A detailed header analysis of ware & software components, services and protocols,
a multiple tactic spoofed e-mail message is carried which provide interoperability between its users and
out in this paper. It also discusses various possibili- among the components along the path of transfer.
ties for detection of spoofed headers and identi ica- The system includes sender’s client and server com-
tion of its originator. Furthermore, dif iculties that puters and receiver’s client and server computers
may be faced by investigators during forensic inves- with required software and services installed on each
tigation of an e-mail message have been discussed of them. Besides, it uses various systems and services
along with their possible solutions [1,5]. of the Internet [2].
This paper will also discuss tracing e-mail head- The sending and receiving servers are always con-
ers and issues associated with it. It will address both nected to the Internet but the sender’s and receiver’s
HTTP & SMTP initiated e-mails. It will discuss dif- client connects to the Internet as and when required.
ferent ways used by e-mail senders to evade tracing An e-mail communication, for example, between a
and workarounds used by investigators to combat sender ‘Alice’ having e-mail address ‘[email protected]’
them. It will also discuss advanced measures and and recipient ‘Bob’ having e-mail address ‘bob@b.
techniques used by investigators to track emails [4]. com’ is shown in Figure 1.
We will discuss particular tools in the paper, such as: ‘Alice’ composes an e-mail message on her com-
EmailTrackerPro and aid4mail in action. puter called client for ‘Bob’ and sends it to her send-
ing server ‘smtp.a.org’ using SMTP protocol. Sending
E-MAIL SERVICE ARCHITECTURE server performs a lookup for the mail exchange record
E-mail system comprises of various hardware and of receiving server ‘b.org’ through Domain Name Sys-
software components that include sender’s client and tem (DNS) protocol on DNS server [3] ‘dns.b.org’. The

December 2018 Journal of Information Technology and Applications 65

JITA 8(2018) 2:64-74 LJUBOMIR LAZIĆ:

Figure 1. E-mail communication between a sender ‘Alice’ and recipient ‘Bob’ [3]

DNS server responds with the highest priority mail ex- tocols which provide interoperability between its
change server ‘mx.b.org’ for the domain ‘b.org’. Sending users and among the components along the path of
server establishes SMTP connection with the receiving transfer. The e-mail architecture shown in Figure 2
server and delivers the e-mail message to the mailbox below speci ies the relationship between its logical
of ‘Bob’ on the receiving server. ‘Bob’ downloads the components for creation, submission, transmission,
message from his mailbox on receiving server to local delivery and reading processes of an e-mail mes-
mailbox on his client computer using POP3 [3] or IMAP sage. Several communicating entities called e-mail
[1] protocols. Optionally, ‘Bob’ can also read the mes- nodes which are essentially software units working
sage stored in his server mailbox without download- on application layer of TCP/IP model are involved
ing it to the local mailbox by using a Webmail program. in the process of e-mail delivery. Nodes working on
E-mail system is an integration of several hard- lower layers such as routers and bridges which rep-
ware and software components, services and pro- resent options to send e-mail without using SMTP

Figure 2. E-mail Architecture [3]

66 Journal of Information Technology and Applications www.jita-au.com

E-MAIL FORENSICS: TECHNIQUES AND TOOLS FOR FORENSICINVESTIGATION OF ONE COURT CASE JITA 8(2018) 2:64-74

are not considered in this architecture because al- • Examining Message ID

most all e-mail communication uses SMTP directly • Examining sender’s IP address
or indirectly. Moreover, proprietary nodes used for Some other aspects that controls forensics step
internal deliveries at sending and receiving servers include the following properties (see Figure 3):
are also not considered in this architecture. 1) Storage format of email: Server side storage
A mail message from Author to Receiver that tra- format may include maildir (each email is kept sepa-
verses through aMUA, aMSA, hMSA, MTA (outbound), rate in a ile, for each user), mbox format (all email
MTA (Inbound), hMDA, rMDA, rMailServ and rMUA iles are in a single text ile). Server-side stores email
is considered as good mail by the Sender Policy Fo- in SQL Server databases. Reading different types of
rum (SPF). Mails following through other paths are formats can be done for forensics analysis by using
either fully or partially non-SMTP based or uses notepad editor and applying regular expression-
non-standard transfer modes which are often sus- based searches [5]. At the client-side, an email is
pected to contain viruses and spam. Delivery Status stored as mbox format (Thunderbird) [5]. Client
Noti ication (DSN) messages are generated by some side may also store emails as .PST (MSOutlook), and
components of MHS (MSA, MTA, or MDA) which pro- NSF (Lotus Notes) iles.
vide information about transfer errors or successful 2) Availability of backup copy of email: When
deliveries and are sent to MailFrom addresses. Mes- checking from the serve side, all copies are trans-
sage Disposition Noti ication (MDN) messages are ferred to the client. This requires seizing the client
generated by rMUA which provide information about computer. For webmail, copies are always saved at
post-delivery processing are sent to Disposition-No- the server side [4].
ti ication-To address. Out Of Of ice (OOO) messages 3) Protocol used to transport email: Email can be
are sent by rMDA to return address [3]. initiated and transported based on SMTP or HTTP
E-mail forensic investigation techniques [2] depending on the email server applications.
E-mail forensics refers to the study of source and
content of e-mail as evidence to identify the actual
sender and recipient of a message, data/time of
transmission, detailed record of e-mail transaction,
intent of the sender, etc. This study involves investi-
gation of metadata, keyword searching, port scan-
ning, etc. for authorship attribution and identi ica-
tion of e-mail scams.
Various approaches that are used for e-mail fo-
rensic are described in [1] and are brie ly de ined
below. E-mail forensic include header analysis, bait
tactics, server investigations, and network device in- Figure 3. Broad steps in email forensics for investigator
vestigation. Besides mandatory headers, custom and
MIME headers appearing in the body of the message Header Analysis
are also analysed for sender mailer ingerprints and Meta data in the e-mail message in the form of
software embedded identi iers. control information i.e. envelope and headers in-
Email Forensics Analysis Steps cluding headers in the message body contain in-
A forensic investigation of e-mail can examine formation about the sender and/or the path along
both email header and body. This paper will look at which the message has traversed. Some of these may
header examination. be spoofed to conceal the identity of the sender. A
According to [3] an investigation should have the detailed analysis of these headers and their correla-
following: tion is performed in header analysis. Besides header
• Examining sender’s e-mail address analysis, various other approaches that can be used
• Examining message initiation protocol (HTTP, for e-mail forensics include bait tactics, server in-
SMTP) vestigations, and network device investigation. Cus-

December 2018 Journal of Information Technology and Applications 67

JITA 8(2018) 2:64-74 LJUBOMIR LAZIĆ:

tom and MIME headers appearing in the body of the Message ID: This is a globally used unique
message are also analysed for sender mailer inger- identi ication ID which refers to the genuine time
prints and software embedded identi iers [2]. of the emails and version of message. It is highly
important to know if investigators want to know
whether spoo ing is done to the email or not.
Relevance of Headers & Components MIME Version: It stands for Multipurpose In-
Email header forensics basically denotes the ex- ternet Mail Extensions and is an Internet Standard
amination done on the email message body and the which extends format of message.
source and path followed by it. This also includes Content-type: This shows the type of con-
the identi ication of genuine sender, time, or recipi- tent or format used for the message like; XLML, Text,
ent of the emails. The email header forensic analy- or HTML.
sis can bring out the candid evidences from various X-Mailer: It displays the email client which is
components included in the header part. Let us see used for sending the message.
Figure 4 which components are helpful for header X-Originating-IP&Received: This is an im-
forensics: portant ield for tracing the IP address used for sending
the email. This is the most important message when it
comes to the email header forensic analysis as it has to
be examined where the mail arrived from.
DKIM-Signature: This ield stores the sig-
nature of an email and all key-fetching information
in simple “tag=value” syntax. It is a crucial ield to
validate the domain name and identity allied to the
message via cryptographic authentication.

SECURITY ISSUES IN INTERNET E-MAIL:

A. Secrecy: The content of email is in plain text
format. While it is transmitting it never decrypted,
Figure 4. A typical E-mail header
so data can be easily revealed if one can get access
of your mailbox and one can knows how to tap net-
work and low.
X-Apparently-To: It will reveal recipient’s B. Integrity: Integrity means changes the origi-
email address while investigating. This can be the nal data. Email is mainly stored in plain text and also
validation ield for checking email service provider. transmitted in plain text. Therefore, anyone can eas-
Generally this ield is referred to as “BCC, CC, or To” ily hack the way of email transmission and change
and is not restricted to “To”. the original data without being noticed by sender
Delivery To: This shows the address of the and receiver.
auto-mailer.
Return-Path: This ield is used for the bounc- Security Issues In SMTP
es of email messages. In case the mail server is send- Security in information technology is de ined as
ing the message and it cannot be delivered. to protect information against unauthorized revela-
Received-SPF: During email header foren- tion as well as unauthorized modi ication. The user
sics, this ield shows the information of email ser- needs to take care about possibility of malicious
vice used for the sending of mails. It is also having and fraudulent attacks by hackers as well as impact
an ID number which is important for log examina- of viruses and denial-of-services attack. Some ap-
tion for determining the validity of an email. In case proaches that are useful for security of your system
of unavailability of the ID, the email must have been include:
spoofed.

68 Journal of Information Technology and Applications www.jita-au.com

E-MAIL FORENSICS: TECHNIQUES AND TOOLS FOR FORENSICINVESTIGATION OF ONE COURT CASE JITA 8(2018) 2:64-74

A. Authentication system. Users cannot request any mail but them get-
The technique can be used to identify and verify ting number of mails of unintended user which can
if anyone is seeking to access un authorized system. be a SPAM mail. Mail iltering cannot ilter legitimate
B. Access control email from SPAM. Virus and SPAM have negligible
Users can be restricted to ensure they only access difference.
data and services for which they have been autho-
rized. Experiment: Man-in-the-Middle Attack
The main purpose of this experiment is to dem-
C. Encryption onstrate the concept of the man-in-the-middle at-
Techniques that scramble data are used to protect tack, the attacker being an NN person. This experi-
information while data are transmitted over network. ment is aimed at capturing data from a suspected
user to connect to a WLAN and viewing unauthor-
D. Firewall ized content that certainly happened in this court
Firewall is mainly used to differentiate the in- case. The experiment shows that the unauthorized
ternal and external information access. Firewall content accessed by the suspicious user can be col-
prevents the outsiders to access information within lected and can be used for a digital forensic investi-
organization. gation. The reader should take into account that all
three actors in this experiment, i.e. router, attacker
E. Intrusion detection and legitimate user (see Figure 5), all at the same
Techniques that monitor the system and network network address, i.e. 146.64 with the remaining two
to check whether anyone is trying to access network numbers indicating the address of each host in the
without authentication. network.

F. Anti-virus software Execution of the experiment

It can detect viruses and prevent access to infect- In this experiment, a forensic researcher points
ed iles. out that the traf ic for this experiment was not en-
crypted. The D-Link router is con igured to be open,
The Threats to Email Security which means that no encryption keys such as WEP,
A. Viruses WPA2, and WPS are con igured.
Email security contains multiple issues. Virus is
the highest risk issue in network. Virus has capabil-
ity to destroy complete data at a time. When virus is
found in any email it can be bring down the entire
mail system, often in a large amount in a single mail.
Many issues can affect the system but virus is
stronger than any other. Virus stays long and de-
stroys data immediately. It is not removed by any
antivirus product. Virus leaves its impact for a long
time and the recovery takes a large amount of mon-
ey, resources and efforts as well as lost computer
information.
Figure 5. Participants in an identity theft experiment

B. SPAM
SPAM is another major issue in network securi- In spite of this, the experiment would continue
ty. Viruses and SPAM go hand in hand. Spam is also to be successful, even if encryption is established,
known as junk email. SPAM mail contains malicious although in this case more efforts should be made
code which affects mail system immediately. SPAM to crack the passwords irst, but it should be empha-
mail contains virus which can bring down the entire sized that communication encryption continues to

December 2018 Journal of Information Technology and Applications 69

JITA 8(2018) 2:64-74 LJUBOMIR LAZIĆ:

be present as the greatest enemy of forensic scien- analysing them we can decode the message being
tists. sent. After decoding, all IP addresses are analysed
The main idea of this experiment is that the at- and their location is traced. A timeline of all event
tacker uses an ARP spoo ing mechanism to convince is made (in universal standard time) and is checked
the legitimate user that they are a legitimate partici- further for suspicious behaviour. Server logs are
pant, device gateway [4]. After the response of a le- checked at the same time to ensure that all the ac-
gitimate user, the attacker immediately con irms to tivities are mentioned in the timeline so formed. If
the gateway that they are a legitimate user. Both the any suspicious activity is found, the mails are recov-
legitimate user and the gateway will think they have ered and can be used as evidence against the send-
established a relationship with each other, and in er. Email is extracted from the client server which
fact they have both established a relationship with keeps a copy of sent mails until a speci ic number.
the attacker. This means that the gateway and le- First case study
gitimate user traf ic is directed towards an attacker First, we will describe a well-known case in court
who can then intercept the communication between practice i.e. a case study involving the use of Manual
the two sides. For the purpose of this experiment, Method for Email Analysis [4] using a whaling attack
the attacker is only interested in the traf ic of a le- which is a spear-phishing attack directed speci i-
gitimate user suspected of being searched for IM- cally at high-pro ile targets like C-level executives,
PORTANT online content. politicians and celebrities:
• An email attached to a $20 million dollar law-
suit purported to be from the CEO of “tech.
EXAMINING E-MAIL FORENSIC TOOLS: CASE STUDIES com” to a venture capital broker. The message
Email analysis, as we already mention, is the outlined guaranteed “warrants” on the next
task performed in the network forensics. Email round of inding for the broker.
analysis is the process which involves analysis of • “tech.com” illed counter claim and claimed
emails sent and received at different ends. In cur- the email was forgery. Their law irm engaged a
rent era, there are very less ways to analyse emails. team to determine the validity of the message.
Most widely accepted method is the Manual Meth- • The team imaged all of the CEO’s computers at
od of Email Analysis [4,5]. Although there have his of ice and his home. Email server backup
been many attempts into securing e-mail systems, tapes were recalled from the client servers.
most are still inadequately secured. Installing an- • All hard drivers and email servers were
tiviruses, ilters, irewalls and scanners is simply searched for “questioned” message. There
not enough to secure e-mail communication. Some were no traces of any such mail on any of the
common examples of illegitimate uses of emails are hard drive or mail spool.
spam, phishing, cyber bullying, botnets, disclosure • When the time stamps and message id’s were
of con idential information, child pornography and compared with the server logs then it was
sexual harassment. The anonymity factor of e-mail found that the “questioned” message have not
has made it dif icult for digital forensic investiga- gone through either “tech.com’s” webmail or
tors to identify the authorship of an email, and to mail server at the time indicated by the date/
aggravate this problem further; there is no stan- time stamp on the message.
dardised procedure to follow. • Based on the analysis the defendants iled mo-
Therefore, a forensic investigator needs ef icient tion to image and examine broker’s computers.
tools and techniques to perform the analysis with a • Federal judge issued subpoena and the team
high degree of accuracy and in a timely fashion. It is arrived at the broker’s business, he refused to
evident that an email forensic tool may only assist the allow his system to image.
investigator during a speci ic stage of analysis [4,5]. • Broker’s lawyer went into the state court, on a
While preforming manual method for email anal- companion case, and got the judge to issue an
ysis, we try to spot spoofed messages which are sent order for a new court appointed examiner.
through SMTP (Simple Mail Transfer Protocol). By • The examination revealed direct proof of the

70 Journal of Information Technology and Applications www.jita-au.com

E-MAIL FORENSICS: TECHNIQUES AND TOOLS FOR FORENSICINVESTIGATION OF ONE COURT CASE JITA 8(2018) 2:64-74

alteration of a valid message’s header to create tion and careful scrutiny should be practiced in inves-
a “questioned” email. tigating every part of the e-mail header.
However, this is quite a bit long and tiring proce-
The allegedly received email dure which would involve too many mails to be ana-
The header of a problematic e-mail is presented lysed, which would be excessively time-consuming.
as follows. Time being the most expensive entity, we need to
Return-Path: CEO [email protected] save the time as much as we can. To save this time
Received: from mail.tech.com (mail.tech.com
[201.10.20.152]) certain tools are present which helps to reduce the
by hedgefund.fund.com (8.11.0/8.11.0) ESMTP id work burden. So, we need a software tools, such as
e73MfZ331592; Thu, 3 Aug 2000 15:45:31 -0400 eMailTrackerPro (http://www.emailtrackerpro.
Received: from webmail.tech.com (webmail.
com/) and Aid4Mail Forensic (http://www.aid-
tech.com
[10.27.30.190]) by mail.tech.com (Switch-2.0.1/ 4mail.com/ ) that are discussed in the next section.
Switch-2.0.1) ESMTP id e73MfW903843; Thu, 3 In this case investigator should look at ESMTP
Aug 2000 14:41:32 -0500 id which is a unique identi ication assigned by each
Received: from tech.com (ostrich.tech.com
[10.27.20.190]) intermediate relay or gateway server. This id is usu-
by webmail.tech.com (8.8.8+Sun/8.8.8) with ally in a hexadecimal string that is reset each day.
ESMTP id RAA01318; Thu, 3 Aug 2000 14:41:31 Resulting in an id that can be resolved to a time win-
-0500
content-class: urn:content-classes:message
dow on a particular server. The investigator should
Subject: Warrants on $25 Million Funding also compare the header information against server
Date: Thu, 3 Aug 2000 14:43:47 -0500 logs: [email protected]. Analysis of the web-
MIME-Version: 1.0
mail server logs revealed several issues regarding
Content-Type: application/ms-tnef;
name="winmail.dat" the validity of the suspect message:
Content-Transfer-Encoding: binary • Matching trace header timestamps and ES-
Message-ID: <[email protected]> MTP ids revealed that RAA01318 was issued
X-MS-Has-Attach:
X-MS-TNEF-Correlator: <3989e793.87BDEEE2@ at 17:41:31 to the authentic message
tech.com> • Comparing the 14:41:31 timestamp of the
Thread-Topic: Warrants on $25 Million Funding suspect message with the log revealed the
Thread-Index: AcHatCZUSkaLe0ajEdaelQACpY-
cy8A==
server was assigning ESMTP ids beginning
From: "CEO [email protected]" <ceo_good_guy@ with “OAA” not “RRA” as represented in the
tech.com > header.
To: "Bad_Guy_Broker" <[email protected]>
Analysis of the mail server logs con irmed that
Information contained in the header can aid inves- the suspect message was not authentic:
tigators in tracing the sender of the e-mail. A thorough • Matching trace header timestamps and ES-
investigation of e-mail headers should include exami- MTP ids revealed that the authentic Message-
nation of the sender’s e-mail address and IP address, ID was logged at 17:41:32 and assigned ES-
examination of the message ID as well as the messag- MTP id e73MfW903843 then it was sent to
ing initiation protocol (HTTP or SMTP). To determine the [email protected] server and it
the source of the e-mail, investigators must irst exam- was assigned a new ESMTP id e73MfZ331592
ine the received section at the bottom of the header and • Comparing the 14:41:32 timestamp of the
work their way up in a bottom to top approach. suspect message with the log revealed there
It is also important that e-mail cases examine the were no messages for over an hour during
logs of all servers in the received chain as soon as pos- that time frame.
sible. Time is very important in e-mail cases as HTTP
and SMTP logs are archived frequently; especially by Second case study
large ISPs. If a log is archived, it could take time and This section describes the court case of cyber-
effort to retrieve and decompress the log iles needed crime so called “identity theft in Internet communi-
to trace e-mails. Some e-mails have fake/forged head- cation by electronic mail by two business entities”.
ers in order to deceive investigators, so extreme cau- Based on the analysis of the method of communica-

December 2018 Journal of Information Technology and Applications 71

JITA 8(2018) 2:64-74 LJUBOMIR LAZIĆ:

tion (e-mails, SMS messages and voice), languages

in business correspondence, frequency of transac-
tions, problems in business, ways of solving them
in over 100 collected e-mails in communication
between two companies during three years of suc-
cessful cooperation, the author of the work came to
indisputable indicators of cybercrime [4]. Identity
theft of e-mail addresses and false communication
with a foreign company was carried out in order Figure 7. Path on the map the message travelled
to indicate that a cash transaction of around EUR
100,000 was paid to the account of NN attackers in After this knowledge, it was necessary to analyse
the London bank, and not to the account in the do- other suspicious e-mails, as well as the email server
mestic Serbian bank to which the money was paid on the victim's side, as we have described earlier.
up to then in the process of electronic payment of It was found that during the time of the hacker at-
goods and services between the parties to the dis- tack, the actual sender did not send any messages.
pute. The process of examining e-mails is described There are many tools which may assist in the study
using the eMailTrackerPro tool in the event of identi- of source and content of e-mail message so that an
ty theft by an NN person (attacker, hacker), an e-mail attack or malicious intent of the intrusions may be
forensic investigation plan, restrictions, an attacker investigated. This section introduces some of these
detection process as the third NN person in an email tools: eMailTrackerPro and Aid4Mail Forensic.
communication, Man-in-the-Middle Attack exper- Software eMailTrackerPro [5] is a proprietary
iment that served as the basis for forensic analysis email forensic solution that analyses email iles
of e-mail in the case study. As for this case, it is nec- stored in local disk and supports automatic email
essary to see from which address the hacker sent a analysis for the identi ication of spamming inci-
message, and through which hopes (jumps through dents. eMailTrackerPro is capable of recovering the
the Internet) a message was sent to reach its desti- IP address that sends the message along with its as-
nation, as can be seen in the following Figure 6 [4]. sociated geographical location (city) to determine
the threat level or validity of an e-mail message. It
can ind the network service provider (ISP) of the
sender. A routing table is provided to identify the
path between the sender and receiver of an email.
It also can check a suspected email against Domain
Name Server blacklists to safeguard against spam.
The disadvantage associated with this software is
that it would be unable to ind a spammer which is
Figure 6. Hopes through which the hacker’s mail passed not blacklisted into its database.

As far as the hopes through which the message Add4Mail forensic software tool
goes, we can see that it is a little unusual that ev- This is another tool developed for helping in the
erything is going from Italy, going to the server in mail sorting purpose only. This software can ind
Slovakia, to the US (forged email address of xxxxx@ emails which can be searched by any particular
yahoo.com), then back to Italy and then to Austra- keyword. As with EmailTrackerPro and on this tool,
lia. The following Figure 7 will show the path on the we need to con igure our mail. Let us choose which
map as the message was traveling. mail we will use for analysis. In this case, we will use
gmail. Once we have completed the mail con igura-
tion, we are going to the next step that allows us to
select the time frame in which we want to search for
mail by keywords, and in the window where Vaccky,

72 Journal of Information Technology and Applications www.jita-au.com

E-MAIL FORENSICS: TECHNIQUES AND TOOLS FOR FORENSICINVESTIGATION OF ONE COURT CASE JITA 8(2018) 2:64-74

VacckY, etc., are located. It is actually a keyword CONCLUSION

search box as in Figure 8. Digital forensic analysis is a complex and time-
consuming process which involves the analysis of
digital evidence. Emails might contain valuable in-
formation that could lead investigators to the iden-
tity and/or location of the offender. Additionally,
email forensic tools through email header analysis
may even reveal information related to the host ma-
chine used during the composition of the message.
In this paper, we have discussed key information
related to email forensic analysis as well as impor-
tant aspects of header tracing. Finally, we have dem-
onstrated two forensic tools that can be utilised for
email analysis emphasising on their key features in
an effort to assist investigators in the selection of
the appropriate tools.
High-tech crime, also known as e-crime or cyber-
Figure 8. Example: Search keywords for a mailbox by Add4Mail crime, includes a set of offenses that involve the use
of the Internet, a computer, or some other electronic
The output provided by this software program is device. This paper describes the court case of cyber-
the message written in the email along with the date, crime, the so-called identity theft in Internet commu-
time and other information speci ic to the mail as in nication via electronic mail by two business entities.
Figure 9. This software program can also be used to Based on the analysis of the method of communica-
fetch some deleted mails from their trash folder. Un- tion (e-mails, SMS messages and voice), languages in
like email tracker pro, this tool does not only serve to business correspondence, frequency of transactions,
track the message, but also for detailed forensic mail problems in business, ways of solving them in over
analysis. This tool can be found at http://www.aid- 100 collected e-mails in communication between two
4mail.com/, but unlike EmailTrackerPro it is not an companies during three years of successful coopera-
open source, you must actually purchase a license. tion, the author of the research came to indisputable
indicators of cyber-crime. Identity theft of e-mail
addresses and false communications with an Italian
irm was carried out in order to indicate that a cash
transaction of around EUR 100,000 was paid to the
account of NN attackers in the London Bank, and not
to the account in the domestic Serbian bank to which
the money had been paid by then in the process of
electronic payment of goods and services between
the parties to the dispute.

Acknowledgements
This research was inancially supported by the Ministry of Science
and Technological Development of the Republic of Serbia, as part of
Figure 9. Example of processing mail by Add4Mail the TR35026 "Software Environment for the optimal management
of the quality software development process" project.
The major disadvantage of this software is that
it can only ind keywords that the user searches. It
has no arti icial intelligence and therefore is a com-
pletely manual software program developed to sort
and ind mails.

December 2018 Journal of Information Technology and Applications 73

JITA 8(2018) 2:64-74 LJUBOMIR LAZIĆ:

REFERENCES [4] Lazic Lj (2018) E-Mail Forensics: The Case From The
[1] Al-Zarouni M (2004) Tracing E-mail Headers, Australian Court Practice Of Theft Of Identity, Conference: ITeO2018,
Computer, Network & Information Forensics Conference, 28. September, Banjaluka, pp. 368- 383.
pp. 16–30. [5] Mrityunjay UC et al. (2017) Novel Approach for Email Fo-
[2] Banday MT (2011) Analysing E-Mail Headers for Forensic rensics, International Journal of Engineering Research &
Investigation, Journal of Digital Forensics, Security and Technology (IJERT), Special Issue.
Law, Vol. 6(2).
[3] Banday MT (2011) Techniques and Tools for Forensic In- Submitted: November 10, 2018
vestigation of E-mail, International Journal of Network Accepted: November 23, 2018
Security & Its Applications, Vol. 3, No. 6.

ABOUT THE AUTHORS

Ljubomir Lazić was born on December “Integrated and Optimized Software Testing Process” in Janu-
18, 1955. He is software engineering and ary, 2007 at University of Belgrade, Faculty of Electrical Engi-
computer science professor at METRO- neering.
POLITAN University, Belgrade, Serbia. He So far, he have authored over 100 research papers. Courses
received the bechelor degree in electrical teach: Software Engineering, Software Project Management,
engineering from School of Electrical En- Software Testing, Human Computer Interaction, Component
gineering, Belgrade University in 1979. He Based Engineering. Current research interests are: Optimal soft-
was a Post-Doctoral Researcher at The WSEAS (The World Sci- ware project management, Software Metrics, Effort Estimation
enti ic and Engineering Academy and Society) of computer sci- Modeling etc. He continue to serve industry in a variety of roles,
ence from 2009 to 2010. He successfully defended PhD thesis: including consulting, executive education, and expert testimony.

FOR CITATION
Ljubomir Lazić, E-Mail Forensics: Techniques And Tools For ForensicInvestigation Of One Court Case, JITA – Journal of Information
Technology and Applications, PanEuropien University APEIRON, Banja Luka, Republika Srpska, Bosna i Hercegovina, JITA 8(2018)
2:64-74, (UDC: 004.42:004.738.5), (DOI: 10.7251/JIT1802064L), Volume 8, Number 2, Banja Luka, december 2018 (45-96), ISSN
2232-9625 (print), ISSN 2233-0194 (online), UDC 004

74 Journal of Information Technology and Applications www.jita-au.com