E-mail Forensics www.paraben.com

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

What is a local storage archive? Local storage archives are any archive that has independent archive format from a mail server. Examples of these types of archives include: .PST, .MBX, .DBX, etc.

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

Basic Rules & Expectations for Local Archives 1. Search for the appropriate mail archives and associated data storage.

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

Program Storage Specifics Index or Table of Contents Mailbox Mailbox Mail Messages

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

Program Storage Specifics Index or Table of Contents

Mailbox Mailbox

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW




Stores: •Main Status •Unread •Read •Forwarded •Redirected •Flagged •Deleted





".

Common Local Storage Archives The Bat! Index: *.tbi Messages: *.tbb

FoxMail Index: *.ind (E-mail Examiner doesn't use this index file) Messages: *.box

The Bat! < v1.42 Index: *.tbx Messages: *.msb

Outlook Express v5/6 Index+Messages: *.dbx or *.MailDB

Forte Agent Index: *.idx Messages: *.dat

MS Outlook Index+Messages: *.pst (by default messages are stored in encrypted format)

Pegasus Index: *.pmi Messages: *.pmm

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

Common Local Storage Archives Cont.

Outlook Express v4.x Index: *.idx Messages: *.mbx Eudora Index: *.toc Messages: *.mbx Poco Index: *.idx Messages: *.mbx Netscape v6.x and 7.x, and Mozilla Index: *.msf Messages: *. Netscape < v6.x Index: *.snm (E-mail Examiner doesn't use this index file) Messages: *. (no extension)

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

Email Reference Cards

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

Basic Rules & Expectations for Local Archives 1. Search for the appropriate mail archives and associated data storage. 2. Process all items with complete structure of: -Header -Body -Attachment to compute verification through hash value

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

E-mail Headers Typically Contain: â&#x20AC;˘Sender E-mail Address â&#x20AC;˘Receiver E-mail Address â&#x20AC;˘Subject â&#x20AC;˘Time of Creation â&#x20AC;˘Delivery stamps â&#x20AC;˘Message Author â&#x20AC;˘CC-Carbon Copy â&#x20AC;˘BCC

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

E-mail Headers-Text Attachments MIME-Version: 1.0 From: Cpt Picard <cptpicard@paraben.com> To: Beverly Crusher <docbev@hotmail.com> Subject:: Pain in my neck Content-Type: multipart/mixed; boundary=boundarystringâ&#x20AC;&#x201D; boundarystring Content-Type: text/plain I seem to have this reoccurring pain in my neck. Please see attachment for more details. Regards, Jean Luc Content-Type: text/plain Content-Disposition: attachment; filename=â&#x20AC;&#x153;neck.txtâ&#x20AC;? It aches in the morning when I wake up for about 20 minutes and also whenever Worf is around. --boundarystring--

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

E-mail Headers-Binary Attachments MIME-Version: 1.0 From: Cpt Picard <cptpicard@paraben.com> To: Beverly Crusher <docbev@hotmail.com> Subject:: Pictures of my neck in zip file Content-Type: multipart/mixed; boundary=boundarystring --boundarystring Content-Type: text/plain Attached is the file neck.zip, which has been base64 encoded. --boundarystring Content-Type: application/octet-stream; name=â&#x20AC;&#x153;neck.zipâ&#x20AC;? Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename=â&#x20AC;&#x153;neck.zipâ&#x20AC;? H52QLID6AJFBALJHLIHKOLNS80JOPSNLJKNLFDLSHFLSHDLFSHLKDNC8 09SAOIHN3OFNSA80HLDBJSUF93HFSLBNCOISAY890EY0AHFLNC739HFO EBOASHOFHSODIY8930â&#x20AC;Ś OAIHOFIDHF8920DFNSOFNDOSGU03UQAFLASNFDLIU03WQJFOSIFH03I9 AHFDALHFNB= --boundarystring--

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

Basic Rules & Expectations for Local Archives 1. Search for the appropriate mail archives and associated data storage. 2. Process all items with complete structure of: -Header -Body -Attachment to compute verification through hash value 3. Watch for virus issues

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

Outlook File Size â&#x20AC;˘ Outlook Pre 2003 â&#x20AC;&#x201C; Maximum archive size is 2 GB

â&#x20AC;˘ Outlook 2003 â&#x20AC;&#x201C; Maximum archive Size is 20 GB

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

E-mail Forensics Server Storage Archives &NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

What is a server storage archive? Server storage archives are any archive that has mixed storage for all of the clients that exist on a server. Examples of these types of archives include: MS Exchange (.EDB), Lotus Notes (.NSF), GroupWise (.DB), etc.

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

MS Exchange PUB.EDB â&#x20AC;˘ Public Information Store â&#x20AC;&#x201C; contains Public Folders â&#x20AC;&#x201C; Public Folders contain information shared amongst the different users.

MS Exchange PRIV.EDB â&#x20AC;˘ Private Information Store â&#x20AC;&#x201C; contains the mailboxes for the server â&#x20AC;&#x201C; keeps information private from other users.

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

MS Exchange PRIV.EDB â&#x20AC;˘ Priv.edb: A rich-text database file containing message headers, message text, and standard attachments.

MS Exchange PRIV.STM â&#x20AC;˘ Priv.stm: A streaming internet content file containing audio, video and other media that are formatted as streams of Multipurpose Internet Mail Extensions (MIME) data.

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

Lotus Notes *.NSF â&#x20AC;˘ Valuable Evidence: â&#x20AC;&#x201C; Messages â&#x20AC;&#x201C; Attachments â&#x20AC;&#x201C; PIM Oriented Data

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

ENCRYPTION

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

Novell GroupWise Post Office Post Office Directory Structure Composed of directories which contain: â&#x20AC;&#x201C; Post Office Database (wphost.db) â&#x20AC;˘ Admin info required to allow users to exchange messages (list of post offices and associated users) â&#x20AC;&#x201C; Message Store â&#x20AC;˘ User databases (userxxx.db) â&#x20AC;˘ Message databases (msgnn.db) â&#x20AC;˘ Attachments directory

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

E-mail to other devices

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

Case Examples &NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".

&NBJM
'PSFOTJDT@#SFBLJOH
"SDIJW








".