The document provides an overview of email headers, detailing their significance for forensic investigations and how to access them in both web-based and desktop email clients. It highlights common fields found in email headers, such as delivery-to, return-path, received, and others, while explaining their roles in the email transmission process. Additionally, it emphasizes the importance of the 'received' field in tracing the path of an email and presents instructions for viewing headers in various email applications.

1. Technical Awareness
on
Analysis of Email Headers

2. Agenda
 Email Headers – A Basic Introduction
 Viewing Email Headers in Web – Based Email
Services
 Viewing Email Headers in Desktop – Based Email
Client Applications
 Common Fields Available in Email Headers – A
Brief Overview
 How Mail Works on the Internet
 Investigating an Email Header – Expert Analysis

3. What is Email Header?
Email Headers are lines of metadata
(data about data) attached to each
email that contain lots of useful
information for a forensic
investigators.

5. Web-Based Email Services
Web-based email allows user to manage
email via a web browser and sent or receive e-mail
from anywhere. E-mail is not downloaded
to a computer, but instead is left on the mail
server until the user delete it.
Examples of Web Based Email Client
Applications are: -
Gmail
Yahoo! Mail

6.  Hotmail
 Google Apps
 Google Apps Admin
 Live Exchange
 Office 365
 IMAP

7. Gmail
• Log in to your Gmail account.
• Open the message you want to view
headers for.
• Click the Down arrow next to the Reply
button, located at the top right of the
message pane.
• Select Show Original.

9. Desktop Based Email Services
Desktop based email clients are mailing
applications that enable the users to easily
manage their email accounts and perform
operations such as sending and receiving
of emails, managing tasks & calendar
items, and many more.
Examples of Desktop Based Email Client
Applications are: -

10.  Microsoft Outlook
 Outlook Express
 Mozilla Thunderbird
 The Bat
 Pocomail
 Lotus Notes
 Mailbird
 Postbox

11. Microsoft Outlook
• Open Outlook.
• Open a message.
• On the Message tab, located in the
Tag group, click the Dialog Box
Launcher icon.
• In the Message Options dialog box, the
headers will appear in the Internet
Headers box.

13. Investigating an Email Header
Expert Analysis

15.  Delivery-To filed of email header shows
the address of automailer.
 Return-Path of email header used for
bounces. The mail server will send a
message to the specified email address if the
message cannot be delivered.
 Received-SPF: Sender Policy
Framework is used to describe what mail
server is allowed to send messages for a
domain.

16.  From: Displays the name of sender.
However, this information can be easily
forged and hence, is least reliable.
 To: Displays the name of receiver.
 Subject: Represent the subject of the
email message.
 Date: Shows the date and time, when the
email message was composed.

17.  Message-ID: Every email should have a
message id field that: "provides a unique
message identifier that refers to a particular
version of a particular message.
 MIME-Version: Multipurpose Internet
Mail Extensions is an Internet Standard that
extends the format of email message.
 Content-Type: Shows the format of the
message, such as html, plain text, xml.

18.  X-Mailer: The email client used to send the
message.
 Content-Language: Specify language used
for content of page.
 X-Antivirus: This states that what the
sender’s antivirus program is such as Norton,
AVG, etc.
 X-Antivirus-Status: It shows that email was
free or not from any viruses.

19. Received

20. Received is the most essential field of the
email header. It creates a list of all the mail
server through which the message traveled in
order to reach the receiver.
The best way to read the received
fields are from bottom to top.
The bottom “Received” shows the IP
address of the sender’s mail server.

21.  The top “Received” shows the IP address
of receiver mail server.
 The middle “Received” shows the IP
address of the mail server through which
email passes from sender to receiver.

22. Message Header View using
MailXaminer
(http://www.mailxaminer.com/product)