Email Forensics

This will be Part I in my two-part E-Mail forensics series exclusive to theblogofbryan.com

Most people these days already have a basic understanding of what email is, or how to use it. Simply type up your message and hit “Send” and like magic, the message is delivered electronically to the recipient you intended. But what is going on behind the scenes may still be widely unknown. Gaining a basic understanding on the underlying technologies used in email communication can be a valuable advantage in any type of cyber crime investigation. This is especially true in such a connected society with the evolution of mobile devices, PDAs, Laptops and more sending and receiving email on a 24×7 basis.

Email can originate from many different types of devices, but the basic communication involved is the same. A user will compose the message on his/her device and then sends it off to some sort of mail server. The mail server acts like an electronic post office, that organizes, receives, and sends electronic mail.

A typical email journey is shown in a very basic visual diagram below:

Diagram of an Email’s Journey

1. Employee (on left) composes email and hits “Send”
2. The first e-mail server located in the senders private network receives the message.
3. The e-mail server then relays the message through the public network to the receiving e-mail server.
4. The final email server receives the message and relays it to the recipient “Uncle Bob” over its own private network.

All the message travels through the communication network shown above, information is logged into a section of information called the e-mail header. The journey can be long or short, and each time the message passes through an e-mail server, information is logged into the e-mail header, it can sometimes be referred to as ESI (Electronicly Stored Information). It is with this ESI logging information, that a forensic examiner can analyze the email communication for use in an investigation. Lets take a look at some basic components of an email.

This is what a typical email client looks like when composing a message, there are text fields where we can specify who the message is intended for, the subject, any attachments, and the body of the message. However, not all information about this e-mail is displayed by the e-mail client. In order to view detailed information about the journey of an e-mail, we must look at the detailed header information below.

12)  X-Message-Info: JGTYoYF78jEv6iDU7aTDV/xX2xdjzKcH
11)  Received: from web11603.mail.yahoo.com ([216.136.172.55]) by mc4­
     f4 with Microsoft SMTPSVC(5.0.2195.5600);
     Mon, 8 Sep 2003 18:53:07 -0700
10)  Message-ID: 20030909015303.27404.qmail@web11603.mail.yahoo.com
9)   Received: from [165.247.94.223] by web11603.mail.yahoo.com via
     HTTP; Mon, 08 Sep 2003 18:53:03 PDT
8)   Date: Mon, 8 Sep 2003 18:53:03 -0700 (PDT)
7)   From: John Sender <sendersname2003@yahoo.com>
6)   Subject: The Plan!
5)   To: RecipientName_1@hotmail.com
4)   MIME-Version: 1.0
     Content-Type: multipart/mixed; boundary=“0-2041413029­
     1063072383=:26811”
3)   Return-Path: sendersname2003@yahoo.com
2)   X-OriginalArrivalTime: 09 Sep 2003 01:53:07.0873 (UTC)
     FILETIME=[1DBDB910:01C37675]
1)   --0-2041413029-1063072383=:26811
     Content-Type: multipart/alternative; boundary="0-871459572­
     1063072383=:26811"
     --0-871459572-1063072383=:26811
     Content-Type: text/plain; charset=us-ascii
     Received the package. Meet me at the boat dock.
     See attached map and account numbers

The logged information above can help assist with determining many useful bits of information, lets break it down and examine the most important parts.

12) X-Message-Info: JGTYoYF78jEv6iDU7aTDV/xX2xdjzKcH

Typically, X-Message info is not a requirement for the delivery of an e-mail. But different ISPs place X information like this for various reasons. An investigator must determine the usefulness of the information by contacting the ISP.

11) Received: from web11603.mail.yahoo.com ([216.136.172.55]) by mc4­f4 with Microsoft SMTPSVC(5.0.2195.5600);Mon, 8 Sep 2003 18:53:07 -0700

The “Received” line is placed by a mail server that receives the message. It identifies the mail server name and IP address typically and creates a unique timestamp that specifies the timezone of where the message was received.

10) Message-ID: 20030909015303.27404.qmail@web11603.mail.yahoo.com
This is a unique identifier that is typically assigned by the first mail server the message was sent to. It can help assist in linking the message to the sender if appropriate logs are maintained.

9) Received: from [165.247.94.223] by web11603.mail.yahoo.com via HTTP; Mon, 08 Sep 2003 18:53:03 PDT

The first received line from the bottom is the first mail server the message was sent to, this is the mail server that created the unique message-ID. It includes information about the server name, IP address, date, and time zone of the mail server. It is important to note that time is originated from the mail server and may not be accurate.

8) Date: Mon, 8 Sep 2003 18:53:03 -0700 (PDT)

This is the date the message was sent. This information is derived from the senders computer and also may not be accurate. If the time/date of the senders machine are not accurate, then that would mean this in the message would also not be accurate.

7) From: John Sender

This line displays the sender of the email. It is typically configured by the senders e-mail client and it is important to note that it can be spoofed and may often be inaccurate.

6) Subject: The Plan!

This is the subject information that is entered by the sender.

5) To: RecipientName_1@hotmail.com

This is the recipient of the message and is entered by the sender.

4) MIME-Version: 1.0 Content-Type: multipart/mixed; boundary=“0-2041413029­1063072383=:26811”

This is encoding information that helps the recipients e-mail client interpret the content of the message.

3) Return-Path: sendersname2003@yahoo.com

This is usually information that is configured by the sender in their e-mail client and may not be accurate or reliable.

2) X-OriginalArrivalTime: 09 Sep 2003 01:53:07.0873 (UTC) FILETIME=[1DBDB910:01C37675]

Typically, X-Message info is not a requirement for the delivery of an e-mail. But different ISPs place X information like this for various reasons. An investigator must determine the usefulness of the information by contacting the ISP.

1) –0-2041413029-1063072383=:26811

This is e-mail client information that is not typically useful in an investigation.

The actual contents in the body of the message, “Meet me at the boat dock.” must be analyzed using traditional methods of criminal investigation.

If you are not a forensic examiner, why is this information still relevant? Well, most of the time, an average person will never have to know anything about it. That is unless you are the curious “geeky” type that might want to view routing information about a recent spam attempt or phishing scam on their e-mail account. Just this morning I quickly reviewed the e-mail header of a spam message trying to get me to click on a link to “Unsubscribe” from “Beautiful Lavender Blooms”. After careful analysis, I was able to determine that the message was indeed SPAM (Duh!) and sourced from a IP Address in Belarus, Amsterdam – spoofed to a Chinese IP Address. By looking at the Received By: line in the header, I can take the IP address and put it into http://ip-lookup.net/index.php where I can view information about the Internet Service Provider that was used, and contact information to dig deeper into the investigation. Cool huh!

Now, the information listed here is only a introduction to forensic examination of e-mails and there is still much to be discussed before we dig into a cyber-crime investigation involving e-mail communication. I will be creating a Part II of the E-Mail forensics series that will dig deep into more advanced techniques and methodologies used in the forensic examination of e-mail messages.

For now, I hope you enjoyed this introduction and stay tuned for similar posts in the near future.

-Bryan

The court has been hearing a case of alleged kidnapping and rape of a woman in Pulwama district.

The Chief Judicial Magistrate (CJM), Pulwama, while ordering a fresh investigation into the case, has observed that the police showed lack of seriousness by assigning the investigation to a head constable.

The offence carries a punishment of up to seven years imprisonment and the law requires that such cases be investigated an officer not below the rank of a sub-inspector.

The investigating official (IO), according to the court, took signatures of two witnesses on blank papers and “in an unfortunate manner did not actually record their statement.”

“The IO has not only failed to adhere with the provisions of law but has also misused his position and spoiled the case in toto,” the order states.

The court has further said that police have often conducted investigation into heinous crimes in a cavalier manner. “During my tenure a number of witnesses have stated before the court that they signed blank papers as they were directed by the police to sign the blank papers,” the CJM, Massarat Shaheen observes.

The judge has expressed deep regret that the police has not been sensitised properly to ensure that heinous cases, which involve heavy punishments, are investigated by responsible officers.

The court has directed the Deputy Inspector General of South Kashmir to conduct the investigation himself or by an officer not below the rank of an SP (superintendent of police) and to take action against the head constable.

The concerned DIG, Vijay Kumar says he has ordered a departmental inquiry against the head constable.

He added that investigation of the case has now been handed over to an officer of the rank of additional superintendent of police.

Political correctness and the fear of offending some constituency also plays a major role. If you are fed up with the refusal of the Presidential candidates to say anything that would actually show a serious grasp of what needs to be done to solve our many national crises, you should not be at all surprised at what happens when we have a high profile murder like the Ridgeway case.

It seems everyone has wanted “justice for Jessica” all along, but be reminded that the one person who seemed to really know what to do when the going got tough was the suspect’s own mother. She is a rare bird who knew her son and had the grit and courage to turn him in. We’re not sure anyone else has figured it out yet.

Now that they’ve got a suspect, everyone is congratulating the police (as they praised Obama for “killing” bin Laden). The tip line is shut down. And everyone is saying, “whew”, it’s over, and we can rest assured that it won’t happen again. Don’t get overconfident. Don Lindlay, a Regis University criminology professor, says we can expect more of the same.

Obama “got” bin Laden, but Al Qaida is just as strong as ever. At the time the government crowed that they had “cut off the head of the snake,” but it was really just an arm of the centipede. It’s the same for the kind of crime for which a suspect was just apprehended. But it took a massive and unprecedented publicity blitz about the case along with a lot of luck  to bring some “closure”.

Question: how often do moms rat on their own kids without pressure from the cops? Answer: almost never.

For the last twenty-five years there have been hundreds, if not thousands, of cases like this one that have been briefly reported and never solved, and have never had any “Justice For…” mobilization as we’ve seen in this instance. There are some even more puzzling cold cases for which little bands of “justice seekers” can still be found trying to sort through clues and lamenting in some cases the incompetence or indifference of the police in solving the mystery.

The purpose of this blog is to put the pieces together as they are picked up one by one. We will also look at the larger picture, including some of these prominent cold cases.

The Jessica Ridgeway picture puzzle is much more complex than many realize, and we will seek to work with all of you to get the real picture, not the oversimplistic and cartoonish one.
Watching Eagle

NEW YORK (WCBS 880) – New York State Attorney General Eric Schneiderman and New York City police commissioner Ray Kelly announced a major takedown of organized crime activity today.

The long-term investigation focused on gambling and loan sharking rings — the real moneymakers for the Gambino crime family.

Kelly said that the 37 defendants were rounded up in a series of early morning raids.

Investigators had used wiretaps, video surveillance, GPS tracking, and bugs placed inside various locations to make their cases.

When the defendants conducted business on street corners, undercover cops were watching.

According to the charges, some of the gambling operations on professional sports and horse racing were run out of offshore wire rooms that generated millions of dollars in wagers.

The investigation was called “Operation Flat Rate.”

“These arrests cripple a network of criminal enterprises and the organized crime family they supported,” Schneiderman said. “The partnership between OCTF and the NYPD provided the skills and resources needed to bring the 37 individuals charged here to justice, and our offices will continue our work to dismantle these criminal ventures.”

“Illegal gambling rings not only promote addiction and burden families with debt from usurious loans, but the proceeds from gambling and loan sharking are used to fuel organized crime and support harmful criminal enterprises,” Kelly said. “I want to commend the New York State Attorney General’s Office and the NYPD’s Organized Crime Investigations Division for today’s arrests.”

The defendants charged today as a result of five separate indictments from a Kings County grand jury are:

Angelo Natoli, 28, Brooklyn
Joseph Casazza, 28, Staten Island
Joseph Russo, 29, Brooklyn
Jason Sobel, 30, Brooklyn
Nicholas Disbrow, 30, Staten Island
Dave Franzese, 32, Staten Island
Michelle Valente, 35, Staten Island
Mark Sini, 35, Staten Island
Nicola Fulciniti, 41, Staten Island
Steve Heisman, 41, Toms River, New Jersey
Louis Lombardo, 41, Brooklyn
Pietro Mastrandrea, 41, Queens
Kenneth Nappi, 42, Brick, New Jersey
Ronald Piggot, 42, Watchung, New Jersey
Michael Epstein, 43, Brooklyn
Michael Bolger, 44, Brick, New Jersey
Arthur Lento 46, Staten Island
Joseph Castellano, 48, Brooklyn
Patrick Prisco, 49, Nutley, New Jersey
Anthony Crapanzano, 49, Barnegat, New Jersey
Bernadette Impliazzo, 50, Staten Island
Steven Fusco, 51, Staten Island
Martin Milone, 53, Marlboro, New Jersey
Christopher Sorrentino, 53, Staten Island
Frank Esposito, 56, Staten Island
John Marinacci, 56, New York, NY
James Outerie, 57, Staten Island
Wane Fasano, 58, Secaucus, New Jersey
Anthony Castellano, 58, Brooklyn
Richard Heck, 61, Queens
Louis Peteroy, 64, Staten Island
Alex Petrillo, 66, Brooklyn
Paul Platania, 67, Queens
Anthony Deluca, 73, Brooklyn
Joseph Esposito, 74, Brooklyn
Vincent Romano, 74, Staten Island
Joseph Gurrieri, 79, Brooklyn

A former “Sopranos” actor and gambling aficionado is accused of being tied to real-life wise guys, according to indictments announced Tuesday by the state attorney general’s office. John Marinacci, 56, of Manhattan, was among the 37 individuals indicted by a Brooklyn grand jury for taking part in a gambling and loan sharking ring allegedly controlled by the Gambino crime family.

Marinacci played a dealer in two “Sopranos” episodes, and also had an unnamed part in “Boardwalk Empire,” according to his IMDB.com profile.

Attorney General Eric Schneiderman said the arrests “cripple a network of criminal enterprises.” Those indicted face up to 25 years in prison on enterprise corruption charges.

                                       Best  EBook  For   $2.99

   “Irma’s House Of Numbers (Counting The Kennedy Conspiracy)” 

                                                        by

                                                   R. A. Baker

                                      (aka Renee Ashley Baker)

Part One–$2.99             Part Two–$9.99           Part Three–$9.99

                                  (Click Link To Amazon)

CLICK   HERE:  http://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Ddigital-text&field-keywords=irma%27s+house+of+numbers

“Irma’s House of Numbers: Counting The Kennedy Conspiracy”

                                              by R.A. Baker

                                 (aka Renee Ashley Baker)

                           (Part 1, Part 2, Part 3, Part 4)

        CLICK LINK BELOW  TO AMAZON: http://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Daps&field-keywords=irma’s+house+of+numbers&rh=i%3Aaps%2Ck%3Airma’s+house+of+numbers&ajr=0

(note:  Please “Buy” DO NOT LEND….)

After watching the way the police have been handling the investigation of the death of Trinidad Arteche Etong, ABS-CBN news anchor Ted Failon’s wife, Filipinos have reason to be afraid–very afraid–of their so-called protectors.

From the time the Quezon City police began working on the case, it was clear they wanted to pin down Failon in a murder charge.

With little to go on but a fertile imagination, Superintendent Frank Mabanag, chief of the Quezon City Police District’s Criminal Investigation and Detection Unit, theorized that Etong could have been killed in their Pajero and brought up to the bathroom where Failon claimed to have found her lying in a pool of blood.

Right in his own house, Failon was made to undergo a paraffin test as police investigators gleefully posed behind him for souvenir photos.

Even as Etong was undergoing emergency treatment for a bullet wound to her head, the police “invited” Failon to submit to an investigation that would drag through the night up to the early hours of morning.

Eight hours later, the investigators finally let him go.

But soon after that, Mabanag announced that a “manhunt” had been launched for the broadcaster who, it turned out, had just gone back to the hospital to be with his wife.

When the paraffin test yielded a negative result, a gentler and more humane police force would have taken it as a cue to ease up a bit and give Failon, his kin and his household some space to rest and maybe try to come to terms with the tragedy.

But no, the frustrating outcome seemed only to have roused the Quezon City police to intensify their persecution of everyone closely or remotely involved in the case.

In a series of operations, policemen arrested first, Failon’s two maids, his driver and a utility man, and later, two of his in-laws.

Especially brutal was the arrest of Failon’s sister-in-law, Pamela Trinchera, who was dragged protesting and screaming out of the hospital where her sister was being treated.

The police recommended that all, except Failon’s brother-in-law, be charged with obstruction of justice, an offense the police were hard put to define.

The four house help stand accused of tampering with evidence because they cleaned up the bathroom where Etong was reportedly found and the car in which Etong was brought to the hospital.

All claimed they did it on their own (to spare Failon’s younger daughter the trauma of seeing her mother’s blood, according to the maids) and without any intention of hiding a crime.

It seems not to have occurred to the investigators that if indeed Etong died by her own hand–a possibility they say they have not ruled out–then no crime was committed, in which case they will have to explain what kind of evidence was tampered with–evidence of a non-crime, perhaps?

The case against Trinchera (which the prosecutor mercifully dismissed) was even curiouser.

The police wanted her charged for blocking a procedure that the policemen themselves described as inconclusive.

That was what they said when the paraffin test on Failon yielded a negative result.

Why did they insist on doing a test that has been discredited (according to one forensic expert) on a woman who was fighting for her life?

It is not for us to say whether Etong’s death was suicide or murder.

What we can say is that what the Quezon City police have done is an overkill.

Chief Superintendent Roberto Rosales, the National Capital Region police chief, says the investigation is being conducted carefully and by the book.

But as crime investigations go, this one has been going at lightning speed for a police force that remains clueless about assassinations of two Cabinet undersecretaries, not to mention the murders of scores of journalists and activists.

It is clear that the investigators are rushing to implicate anyone and everyone on anything, and especially Failon if they can.

And the reason is obvious: Failon has been a thorn in the side of the Quezon City police, with his biting radio commentaries on the rubout of suspected car thieves on EDSA a couple of months ago and the recent upsurge of carjacking cases in the city.

This is sweet revenge for some city police officers, and they don’t care who gets hurt.

Neither do they care if the whole nation watches as they wage their vendetta in the glare of television cameras.

Their message to the media and the public is unmistakable: Don’t mess with us or else…

Perhaps it is time Filipinos began to ask whether they should continue to support with their taxes an organization that is going berserk.

Continuing to do so is beginning to look like suicide.

After watching the way the police have been handling the investigation of the death of Trinidad Arteche Etong, ABS-CBN news anchor Ted Failon’s wife, Filipinos have reason to be afraid–very afraid–of their so-called protectors.

From the time the Quezon City police began working on the case, it was clear they wanted to pin down Failon in a murder charge.

With little to go on but a fertile imagination, Superintendent Frank Mabanag, chief of the Quezon City Police District’s Criminal Investigation and Detection Unit, theorized that Etong could have been killed in their Pajero and brought up to the bathroom where Failon claimed to have found her lying in a pool of blood.

Right in his own house, Failon was made to undergo a paraffin test as police investigators gleefully posed behind him for souvenir photos.

Even as Etong was undergoing emergency treatment for a bullet wound to her head, the police “invited” Failon to submit to an investigation that would drag through the night up to the early hours of morning.

Eight hours later, the investigators finally let him go.

But soon after that, Mabanag announced that a “manhunt” had been launched for the broadcaster who, it turned out, had just gone back to the hospital to be with his wife.

When the paraffin test yielded a negative result, a gentler and more humane police force would have taken it as a cue to ease up a bit and give Failon, his kin and his household some space to rest and maybe try to come to terms with the tragedy.

But no, the frustrating outcome seemed only to have roused the Quezon City police to intensify their persecution of everyone closely or remotely involved in the case.

In a series of operations, policemen arrested first, Failon’s two maids, his driver and a utility man, and later, two of his in-laws.

Especially brutal was the arrest of Failon’s sister-in-law, Pamela Trinchera, who was dragged protesting and screaming out of the hospital where her sister was being treated.

The police recommended that all, except Failon’s brother-in-law, be charged with obstruction of justice, an offense the police were hard put to define.

The four house help stand accused of tampering with evidence because they cleaned up the bathroom where Etong was reportedly found and the car in which Etong was brought to the hospital.

All claimed they did it on their own (to spare Failon’s younger daughter the trauma of seeing her mother’s blood, according to the maids) and without any intention of hiding a crime.

It seems not to have occurred to the investigators that if indeed Etong died by her own hand–a possibility they say they have not ruled out–then no crime was committed, in which case they will have to explain what kind of evidence was tampered with–evidence of a non-crime, perhaps?

The case against Trinchera (which the prosecutor mercifully dismissed) was even curiouser.

The police wanted her charged for blocking a procedure that the policemen themselves described as inconclusive.

That was what they said when the paraffin test on Failon yielded a negative result.

Why did they insist on doing a test that has been discredited (according to one forensic expert) on a woman who was fighting for her life?

It is not for us to say whether Etong’s death was suicide or murder.

What we can say is that what the Quezon City police have done is an overkill.

Chief Superintendent Roberto Rosales, the National Capital Region police chief, says the investigation is being conducted carefully and by the book.

But as crime investigations go, this one has been going at lightning speed for a police force that remains clueless about assassinations of two Cabinet undersecretaries, not to mention the murders of scores of journalists and activists.

It is clear that the investigators are rushing to implicate anyone and everyone on anything, and especially Failon if they can.

And the reason is obvious: Failon has been a thorn in the side of the Quezon City police, with his biting radio commentaries on the rubout of suspected car thieves on EDSA a couple of months ago and the recent upsurge of carjacking cases in the city.

This is sweet revenge for some city police officers, and they don’t care who gets hurt.

Neither do they care if the whole nation watches as they wage their vendetta in the glare of television cameras.

Their message to the media and the public is unmistakable: Don’t mess with us or else…

Perhaps it is time Filipinos began to ask whether they should continue to support with their taxes an organization that is going berserk.

Continuing to do so is beginning to look like suicide.