>> Hey, everyone. Welcome back to the course.
The last video we talked about
different types of email crimes.
In this video, we're going to talk about
Microsoft Exchange, e-mail laws.
Some other laws besides
a canned spam act that may be applicable in
your email investigation or
the Electronic Communications Privacy Act or
ECPA and the Stored Communications Act as well.
Now you also might see that different states have laws
regarding obtaining information from
e-mails or e-mail related information,
as well as different locales.
One county I know of in Texas,
Harris County has pretty strict cyber laws,
whereas other counties may not.
It may be at the local level as well.
The email investigation itself.
Obviously, we will always want to get
a search warrant first,
and then we want to make a copy of the emails or
email information and preferably a bit by bit copy.
In some instances, we may also print out
the email as part of our investigation.
Then from there we just view or
analyze the email header or try to trace
back whoever sent it, as much as we can.
A lot of times with spoofing,
we can't trace it all the way back.
Investigate different types of encoding,
and then also acquire an email or archives as well.
Just an example of an email header.
You see the two in the front fields there.
You'll also see an IP address in there as well.
I'm showing that, hey,
it's received from this IP address,
which is the 106 dot 10 dot 165 dot 32.
Again, whether or not that's actually accurate.
Because you can spoof an IP address.
Well, some areas you can search on
the suspect machine is going to be the browser cache,
as well as using different tools that are specifically
designed to grab information from web emails.
Microsoft Exchange, e-mail server logs.
Exchange works as the extensible storage engine.
The different archive logs we want to get are going to
be PRIV dot EDB PUB dot EDB,
and PRIV dot STM.
You'll definitely want to know those for
your exam as well as the tracking dot log file.
PRIV dot EDB is
a rich text file that
contains message headers and message texts,
as well as standard attachments.
PUB dot EDB contains public folder hierarchies,
excuse me, and contents.
Then PRIV dot STM is regarding
the streaming internet content file.
Things like your mind,
which contains your video and audio files.
Different tools we can use for e-mail recovery.
Some of the more popular ones are
going to be ProDiscover Basic,
OSForensics and Paraben email
examiner as well as the AccessData FTK.
Just a screenshot of all of those.
Prodiscover Basic OSForensics,
DataNewman, paraben E-mail Examiner again,
I mentioned this is probably one of
the most popular ones to use.
AccessData FTK, another very popular tool.
Fookes Aid4Mail.
Just a couple of quick posted assessment questions.
The PRIV dot EDB archive database file
contains message headers,
message text,
and standard attachments. Is that true or false?
That's true if you remember,
that one contains that and
definitely remember this for your exam.
Our next question here, the PUB
dot EDB file stores
public folder hierarchies and contents.
Is that one true or false?
All right that one's true again as well.
Again, you definitely, definitely want
to memorize and make sure you
know those three that I mentioned for the exam.
It's got a very, very, very beneficial to you.
In this module, we wrapped up our discussion
on investigating email crimes.
We've talked about Exchange e-mail logs
and some of the other laws
that we need to worry about as
doing an email investigation.
The next module we're going to talk
about mobile forensics.