Email Tracing.ppt

Email Tracing Computer Forensics 152 / 252 Email Investigations: Overview Email has become a primary means of communication. Email can easily be forged. Email can be abused Spam Aid in committing a crime … Threatening email, … Email Investigations: Overview Email evidence: Is in the email itself (header) Left behind as the email travels from sender to recipient. Contained in the various logs. Law enforcement can use subpoenas System ads have some logs. Email Fundamentals Email travels from originating computer to the receiving computer through email servers. All email servers add to the header. Use important internet services to interpret and verify data in a header. Email Fundamentals Typical path of an email message: Email Fundamentals:Important Services Verification of IP addresses: Regional Internet Registry APNIC (Asia Pacific Network Information Centre). ARIN (American Registry of Internet Numbers). LACNIC Latin American and Caribbean IP address Regional Registry. RIPE NCC (Réseau IP Européens Network Coordination Centre). Whois Numerous other websites. Email Fundamentals: Important Services Domain Name System (DNS) translates between domain names and IP address. Name to address lookup: Parses HOSTS file. Asks local nameserver Local nameserver contacts nameserver responsible for domain. If necessary, contact root nameserver. Remote nameserver sends data back to local nameserver. Local nameserver caches info and informs client. HOSTS files can be altered. You can use this as a low-tech tool to block pop-ups. Local nameservers can/could be tricked into accepting unsolicited data to be cached. “Hilary for Senate” – case. Email Fundamentals IP-Addressing IP Version 4 is slowly replaced by IP Version 6. IPv4: 4 digital numbers between 0 and 255. IPv6: 8 digital numbers between 0000 and 0xffff. Static / dynamic addresses Dynamic addresses assigned by DHCP within a local domain (with same leading portion of IP address). Email Fundamentals: Important Services Ma