Skip to content

Understanding Email Forensics

Email forensics examines mail stores, messages, headers, bodies, attachments, and related records to reconstruct communication and assess provenance.

What you will learn

By the end, you should be able to distinguish displayed sender information from transport evidence, preserve mailbox structure, and handle attachments safely.

What is email forensics?

Core concept

Email evidence may exist as PST or OST files, MBOX data, individual messages, server exports, or application databases. A message includes user-visible content and technical metadata that may describe routing, identifiers, authentication, and formatting.

HeadersBodyAttachmentsFoldersMessage IDs

Keep in mind: The visible From field can be misleading. Evaluate transport headers, authentication results, server records, account context, and message construction together.

01PSTAn Outlook data file commonly used for stored mail02OSTAn Outlook offline cache associated with an account03Message IDA message identifier that can support correlation

Email evidence layers

Mailbox structureFolders, account context, message state, and relationships
Message contentSubject, body, recipients, and embedded resources
Transport headersRouting, timestamps, servers, and authentication results
Attachments and linksFiles and destinations requiring separate safe analysis

Why it matters

Reconstruct communication

Messages, folders, identifiers, and replies can show a communication sequence.

Assess provenance

Headers and server context help evaluate where a message travelled.

Preserve attachments

Attachments can be exported, hashed, and transferred into a safe analysis workflow.

Correlate activity

URLs, files, accounts, and times can be compared with browser and endpoint evidence.

How email analysis works

  1. PreserveRetain the source mail store or message, record acquisition details, and calculate hashes.
  2. OrientIdentify account, folders, time context, synchronisation state, and available server evidence.
  3. ExamineReview message content, headers, identifiers, authentication results, and conversation relationships.
  4. Extract safelyExport attachments and links without opening them on the analyst workstation.
  5. CorrelateCompare accounts, files, URLs, browser records, endpoint activity, and server logs.

Choose the next step

ScenarioA message displays the chief executive's name but asks for an unusual payment. What is the best first forensic step?

Keep message layers together

  1. 1PreserveRetain source mail data and hashes.
  2. 2InspectReview content, headers, and identifiers.
  3. 3ExtractHandle links and attachments safely.
  4. 4CorrelateConnect server, account, browser, and endpoint evidence.

Email-forensics tools in SUSA

PST and OST review

XstReader

Browse Outlook data files, folders, messages, and attachments.

PST viewer

Kernel Outlook PST Viewer

Review PST content through a graphical interface.

Command-line export

pffexport

Export content from Personal Folder File data.

Continue learning