Digital Forensics Explained, 2nd Edition

Chapter 4Internet and e-mail examinations

Introduction

E-mail is an interesting phenomenon in that it often documents a person’s activities and choices in a written format – signed, dated, and with witnesses (recipients) no less. E-mail can help prove that something happened, provide an alibi, or provide a noose that hangs someone. E-mail is one of the most important areas that an examiner concentrates on during an examination.

Internet activity provides a window into an individual’s interests and inclinations, and reviewing the artifacts left behind by his or her activity can lend significant insight into what an individual has been doing. There are a lot of potential places to look for clues of Internet behavior including chat and messaging ...