Tracing E-mail Headers.

Abstract

This paper will discuss tracing e-mail headers and issues associated with it. It will address both HTTP & SMTP initiated e-mails. It will discuss different ways used by e-mail senders to evade tracing and workarounds used by investigators to combat them. It will also discuss advanced measures and techniques used by investigators to track emails. The paper will not however discuss any particular tools nor endorse any software products in its coverage. Keywords E-mail forensics, tracing e-mail headers, e-mail tracking, network forensics, fake e-mails, web mail tracking, SMTP tracing, e-mail tunnelling, e-mail anonymity, mail relay, e-mail false headers. E-MAIL COMPONENTS E-mails are made of two main parts; they are the message header and message body. The header part contains routing information about the e-mail and other information such as the source and destination of the e-mail, the IP address of the sender and time related information. The message body contains the actual message of the email, i.e. message subject and body. The body might also contain attachments in the form of MIME or SMIME (Lewis, 2004). Message headers are the important part for investigating e-mail messages and will be discussed