Digital forensic analysis of emails

Nowadays, emails are commonly used as evidence to prove or challenge facts in legal proceedings. When one or more messages are relevant to a case, it may be necessary to analyse not only their visible content, but also their electronic format, technical headers, route between servers, authentication mechanisms and attachments.

A printout, screenshot or PDF document may be useful for displaying the content of an email, but they do not normally preserve all the information required to examine its origin, authenticity and integrity. When these aspects are disputed, the analysis should be carried out, whenever possible, using the message stored in the email account, its electronic file and any other available evidence.

What do we analyse in a forensic examination of emails?

• Preservation and chain of custody: controlled acquisition and preservation of emails and their attachments, documenting their origin and the actions carried out during the analysis.
• Origin, authenticity and integrity of the email: combined analysis of the message, its headers and the other available evidence in order to assess its origin, verify its consistency and identify possible indications of modification.
• Analysis of headers and message route: examination of fields such as From, To, Date, Message-ID, Received, Return-Path and Reply-To, as well as the servers, IP addresses and timestamps recorded during transmission.
• Verification of SPF, DKIM and DMARC: review of the authentication mechanisms present in the email to determine whether the server from which it was sent was authorised by the sending domain and whether the message passed the technical authentication and integrity checks.
• Analysis of dates and chronology: comparison of sending and receipt dates, time zones, replies, forwards and other events related to the communication.
• Analysis of attachments: identification of the documents linked to the message, calculation of their hash values and examination of their formats, metadata and relationship with the email.
• Analysis of information provided by service providers: technical examination of reports, logs or documentation supplied by Microsoft, Google, system administrators or other providers, comparing their content with the available evidence.
• Counter-expert examination of emails: review of messages and reports submitted by another party to verify the preservation of the evidence, the methodology applied and whether the conclusions are supported by the analysed data.