System Forensics, Investigation, and Response, 3rd Edition

Tracing Email

Email tracing involves examining email header information to look for clues about where a message has been. This will be one of your more frequent responsibilities as a forensic investigator. You will often use audits or paper trails of email traffic as evidence in court. Many investigators recommend use of the tracert command. However, because of the dynamic nature of the Internet, tracert does not provide reliable, consistent, or accurate routing information for an email. To prove this, you can simply compare the routing from the email header to the results shown by tracert. The results are likely different, and the greater the distance between sender and receiver, the bigger the difference between the theoretical tracert results ...