Computer Forensics

1
Computer Forensics

• Email Tracing Examples

2

• Microsoft Mail Internet Headers Version
  2.0Received from SEARCH.ORG (64.162.18.2) by
  sgisrv1.search.org with Microsoft
  SMTPSVC(5.0.2195.3779) Wed, 23 Oct 2002 105319
  0700Received from hotmail.com
  (216.33.240.88) by SEARCH.ORG with ESMTP
  (IOA-IPAD 2.54) id 4171800 Wed, 23 Oct 2002
  105954 0800Received from mail pickup service
  by hotmail.com with Microsoft SMTPSVC Wed, 23
  Oct 2002 105319 0700X-Originating-IP
  64.162.18.159From "TC" boston17_at_hotmail.comTo
  jqs_at_search.orgSubject Kittens for saleDate
  Wed, 23 Oct 2002 104816 0700MIME-Version
  1.0Content-Type multipart/alternative
  boundary"----_NextPart_000_000A_01C27A81.B1743CB
  0X-Priority 3X-MSMail-Priority
  NormalX-Mailer Microsoft Outlook Express
  6.00.2600.0000X-MimeOLE Produced By Microsoft
  MimeOLE V6.00.2600.0000Message-ID
  OE31FFsAitVGeSJIEoP00003f05_at_hotmail.comX-Original
  ArrivalTime 23 Oct 2002 175319.0069 (UTC)
  FILETIME1216D8D001C27ABDReturn-Path
  boston17_at_hotmail.com

3
From tschwarz_at_cse.ucsc.edu Fri Jan 16 155111
2004 Return-Path lttschwarz_at_cse.ucsc.edugt Received
from sundance.cse.ucsc.edu (sundance.cse.ucsc.ed
u 128.114.48.62) by server4.engr.scu.edu
(8.12.10/8.12.10) with SMTP id i0GNpA8K007608
for lttschwarz_at_engr.scu.edugt Fri, 16 Jan
2004 155110 -0800 Received (from
tschwarz_at_localhost) by sundance.cse.ucsc.edu
(8.6.10/8.6.12) id PAA18463 for
tschwarz_at_engr.scu.edu Fri, 16 Jan 2004 155110
-0800 Date Fri, 16 Jan 2004 155110 -0800 From
Thomas Schwarz lttschwarz_at_cse.ucsc.edugt Message-Id
lt200401162351.PAA18463_at_sundance.cse.ucsc.edugt To
tschwarz_at_engr.scu.edu Subject
email X-Spam-Checker-Version SpamAssassin
2.60-rc3 (1.202-2003-08-29-exp) on
server4.engr.scu.edu X-Spam-Level X-Spam-Status
No, hits0.0 required5.0 testsnone
autolearnham version2.60-r c3 This is a test.
4

• Return-Path ltrhn-bounce2443612-3000675_at_rhn.redha
  t.comgt
• Received from rhn-mail.rdu.redhat.com
  (mail.rhn.redhat.com) 66.187.232.120 by
  mail.zionsvillepd.com (8.12.8/8.12.5) with ESMTP
  id h5J5iCjI022534
• for ltjmorris_at_zionsvillepd.comgt Thu, 19 Jun
  2003 004413 -0500
• Received from admin.rdu-colo.redhat.com
  (nat-pix.rdu-colo.redhat.com 10.255.17.200
• by rhn_mail.rdu-colo.redhat.com (8.11.6/8.11.6)
  with ESMTP id h5J5amx01895
• for ltjmorris_at_zionsvillepd.comgt Thu, 19 Jun 2003
  013649 -0400
• Received from admin.rhu-colo.redhat.com
  (localhost.localdomain 127.0.0.1)
• by admin.rdu-colo.redhat.com (8.11.6/8.11.6)
  with ESMTP id h5J5WW920293
• for ltjmorris_at_zionsvillepd.comgt Thu, 19 Jun 2003
  013232 -0400
• Date Thu, 19 Jun 2003 013232 -0400
• Message-Id lt200306190532.h5J5WW920293_at_admin.rdu-c
  olo.redhat.comgt
• Subject RHN Errata Alert Updated WindowMaker
  packages fix vulnerability in theme-loading
• Content-Type TEXT/PLAIN charsetUS-ASCII
• X-RHN-Info Autogenerated mail for ZPD
• X-RHN-Email ltjmorris_at_zionsvillepd.comgt
• Precedence first-class
• Errors-To rhn-bounce2443612-3000675_at_rhn.redhat.c
  om
• From Red Hat Network Alert ltrhn-admin_at_rhn.redhat.
  comgt
• To ZPD ltjmorris_at_zionsvillepd.comgt

5
From mixmaster_at_futureworlds.it Fri Jan 16
154507 2004 Return-Path ltmixmaster_at_futureworlds
.itgt Received from www.futureworlds.it
(ip-081-104.customer.panservice.it
212.66.10 4.81) by server4.engr.scu.edu
(8.12.10/8.12.10) with ESMTP id i0GNj58K004457
for lttschwarz_at_engr.scu.edugt Fri, 16 Jan
2004 154506 -0800 Received by
www.futureworlds.it (Postfix, from userid 1011)
id 8CE991F0F5A Sat, 17 Jan 2004 004501
0100 (CET) From futureworlds ltnobody_at_mail.future
worlds.itgt To tschwarz_at_engr.scu.edu Subject
Test Message-ID lt06e358af1c20ba88603856b809ead72d
_at_mail.futureworlds.itgt Date Sat, 17 Jan 2004
004501 0100 (CET) X-Spam-Checker-Version
SpamAssassin 2.60-rc3 (1.202-2003-08-29-exp) on
server4.engr.scu.edu X-Spam-Level X-Spam-St
atus No, hits0.0 required5.0 testsnone
autolearnham version2.60-rc3