SEU S-663 Digital Forensics: Email Forensic Investigation Presentation

This presentation, created for non-technical staff, provides an overview of email forensic investigations. It begins by defining information security and highlighting common threats, such as software attacks and identity theft. The core of the presentation focuses on email forensic techniques, explaining how email messages are analyzed to uncover critical information. The presentation details the process of email investigation, including header analysis, server investigation, and network device investigation. It further explains how these methods help in identifying the sender, tracking email paths, and extracting relevant data from server logs and attached files. The presentation concludes by emphasizing the importance of securing sensitive information and highlights the role of email forensics in modern investigations. References are provided to support the information presented.

INFORMATION SECURITY

INTRODUCTION
• This refers to the particular practice of
protecting the information and deals with the
risk management of the same.
• Information security is also termed as InfoSec
(Ghafarian, 2019).
• This involves the prevention of any specific
unauthorized access into the information
segment of an organization.

THREATS TO INFORMATION
SECURITY
Some of the common threats to the field of
information security are,
• Software related attacks.
• Theft of identity belonging to different
individuals.
• Extortion of information.

EMAIL FORENSIC
• Email forensic refers to the study of source as
well as content belonging to an email message
that might act as an evidence.
• This process can also be properly utilized for the
purpose of identifying a criminal with proper
identification of the actual sender as well as the
receiver (Stadlinger & Dewald, 2017).
• The email also highlights other constraints such
as the time the respective email was sent as well
as received.

PROCESS OF EMAIL INVESTIGATION
• Firstly, an email is taken and it is
analyzed by analyzing the headers of
the email at the first instance.
• Inconsistencies observed within the
data that is communicated within
subsequent servers of SMTP refer to
the fact that the email is fake.
• The sender of the email can be tracked
by following the path of the email that
has be kept under investigation.

PROCESS OF EMAIL INVESTIGATION
(CONTD.)
• Server investigation refers to the procedure of
investigating the emails that have been
delivered as well as the copies of the same
email.
• Some of the organizations operating within the
field of business provision the employees with a
separate box of email for having the possession
of mail servers (Morovati & Kadam, 2019).
• In the procedure of server investigation the
entire email box is extracted to get hold of
evidences.

PROCESS OF EMAIL INVESTIGATION
(CONTD.)
• Network device investigation refers to the
investigating of logs that are specifically
maintained by the network devices such as the
likes of firewalls, switches as well as routers.
• This procedure is specifically carried out for the
purpose of investigating the source of the email.
• This might even lead to a complex situation in
the end.

INFORMATION UNCOVERING BY EMAIL
FORENSIC
• With the header analysis in email forensic
investigation the path of the email can be
tracked and the sender of the email can also be
get hold.
• With the help of the network device
investigation, the logs that belong to various
network devices can be extracted.
• With the procedure of server investigation, the
delivered emails as well as server logs are the
information that is extracted through the
procedure.

INFORMATION UNCOVERING BY EMAIL FORENSIC
(CONTD.)
• With the help of the software embedded analysis,
the documents or the attached files to the emails
are extracted that is sent by the sender to get hold
of more information regarding the sender of the
email.
• During the procedure of analyzing the mail
fingerprints of the sender, the information that is
generated by the mail servers are extracted to
progress with the process of forensic investigation.

CONCLUSION
• This presentation highlights the importance
of securing the sensitive information
belonging to individuals.
• Forensic investigations include the primary
procedure of email forensic that investigates
email messages to proceed with
investigations.
• Email forensic retrieve multiple forms of
information such as sender information and
server logs to get hold of the source.
• Email forensic also provisions with a helping
hand towards extracting files or documents
that are sent by the sender to the receiver.

REFERENCES
• Ghafarian, A. (2019, July). Capabilities of Email Forensic Tools. In Intelligent Computing-
Proceedings of the Computing Conference (pp. 514-528). Springer, Cham.
• Stadlinger, J., & Dewald, A. (2017). A forensic email analysis tool using dynamic visualization.
Journal of Digital Forensics, Security and Law, 12(1), 6.
• Morovati, K., & Kadam, S. S. (2019). Detection of Phishing Emails with Email Forensic Analysis
and Machine Learning Techniques. International Journal of Cyber-Security and Digital Forensics,
8(2), 98-108.

THANK YOU!