Five on Forensics Page 1 - Craig Ball

<strong>Five</strong> on Forensics
© 2002-2008 Craig Ball All Rights Reserved
Meeting the Challenge: E-Mail in Civil Discovery
Craig Ball
Table of Contents
Not Enough Eyeballs........................................................................................ 48
Test Your E.Q.................................................................................................... 49
Staying Out of Trouble..................................................................................... 50
…And You Could Make Spitballs with It, Too ................................................ 50
Did You Say Billion? ........................................................................................ 50
Net Full of Holes ............................................................................................... 51
E-Mail Systems and Files................................................................................. 51
A Snippet about Protocols............................................................................... 51
Incoming Mail: POP, IMAP, MAPI and HTTP E-Mail....................................... 51
Outgoing Mail: SMTP and MTA ....................................................................... 53
Anatomy of an E-Mail Header.......................................................................... 53
Tracing an E-Mail’s Incredible Journey .......................................................... 54
Local E-Mail Storage Formats and Locations ................................................ 56
Finding Outlook Express E-Mail...................................................................... 57
Finding Netscape E-Mail .................................................................................. 58
Finding Outlook E-Mail .................................................................................... 58
Finding E-Mail on Exchange Servers.............................................................. 59
Understanding Server Back Up, by Analogy.................................................. 60
Brick Level Back Up ......................................................................................... 62
The Format Fight .............................................................................................. 62
What Format Do You Want? ............................................................................ 63
Privilege and Confidentiality Considerations ................................................ 63
Claw Back and Quick Peek Arrangements..................................................... 64
Preparing for E-Mail Discovery ....................................................................... 64
Planning and Policymaking............................................................................. 65
Dear David Duncan, Regards Nancy Temple ................................................. 66
Trust Everyone, but Cut the Cards ................................................................. 66
Am I in Trouble? IM! ......................................................................................... 66
Page 47