Page last updated on Tuesday, April 4 2006 at 1533 UK

Email Forensics

Recovering, reconstructing and examining email messages and their attachments

When it comes to computer forensics, one of the most common requests we receive is to examine email correspondence. This can be complicated and difficult because of the many different types of email archives and because relatively minor damage to a mail store can render large volumes of data inaccessible.

To help us to deal with diverse email systems, we use a range of well-recognised and proven software tools as well as some proprietary techniques which are exclusive to TKM Technologies. These allow us to recover messages from damaged email systems whilst preserving the integrity of the messages and any attachments.

Where damage to an email system is particularly extensive, we are able comb through the raw data to identify sufficient file structure to either reconstruct the mail store or extract the email messages as fragments. From this point, we are able to add the email messages and attachments to a case file, where they can be analysed using a range of sophisticated search tools.

Forensic Procedure

In some cases, the information contained in email correspondence might be the subject of a criminal of civil action. In other circumstances, the action which caused the email system to fail might be under investigation.

In either case, we use accepted forensic procedure to maximise the recoverable data whilst ensuring that any evidence will withstand scrutiny within the framework of a criminal or civil investigation.

Desktop Email Recovery (e.g. Microsoft Outlook)

Microsoft Outlook .PST files have a complex structure. Even very minor damage can render the files inaccessible and beyond the repair abilities of the Microsoft Inbox Repair Utility. In any case, if the evidence is to be used to support a criminal or civil action, specialist forensic expertise is required to preserve the integrity of the email messages.

By using software and procedures developed in-house, we are able to comb the data in a damaged Outlook .PST file to reconstruct messages and attachments. We can even recover messages which appear to have been deleted by the user.

As well as Microsoft Outlook .PST files, we can recover email messages from Outlook Express .DBX files, AOL Mail, Eudora, Netscape Mail and various other formats.

Network Email Systems

With networked email systems, such as Microsoft Exchange Server, we use specialist forensic software to read the structure of the mail store and create an index of the individual users. This allows us to examine each user’s email correspondence and export a complete database of their messages and attachments.

We then add this database to a case file, where it can be analysed alongside other evidence using a range of powerful search tools.

Print page Print this article