9th IEEE International Conference on Collaborative Computing: Networking, Applications and Worksharing

Research Article

Towards Comprehensive and Collaborative Forensics on Email Evidence

Download28 downloads
  • @INPROCEEDINGS{10.4108/icst.collaboratecom.2013.254125,
        author={Justin Paglierani and Mike Mabey and Gail-Joon Ahn},
        title={Towards Comprehensive and Collaborative Forensics on Email Evidence},
        proceedings={9th IEEE International Conference on Collaborative Computing: Networking, Applications and Worksharing},
        publisher={ICST},
        proceedings_a={COLLABORATECOM},
        year={2013},
        month={11},
        keywords={forensics email collaboration},
        doi={10.4108/icst.collaboratecom.2013.254125}
    }
    
  • Justin Paglierani
    Mike Mabey
    Gail-Joon Ahn
    Year: 2013
    Towards Comprehensive and Collaborative Forensics on Email Evidence
    COLLABORATECOM
    IEEE
    DOI: 10.4108/icst.collaboratecom.2013.254125
Justin Paglierani1, Mike Mabey1, Gail-Joon Ahn1,*
  • 1: Arizona State University
*Contact email: gahn@asu.edu

Abstract

The digital forensics community has neglected email forensics as a process, despite the fact that email remains an important tool in the commission of crime. At present, there exists little support for discovering, acquiring, and analyzing web-based email, despite its widespread use. In this paper we present a systematic process for email forensics which we integrate into the normal forensic analysis workflow, and which accommodates the distinct characteristics of email evidence. Our process focuses on detecting the presence of non-obvious artifacts related to email accounts, retrieving the data from the service provider, and representing email in a well-structured format based on existing standards. As a result, developers and organizations can collaboratively create and use analysis tools that can analyze email evidence from any source in the same fashion and the examiner can access additional data relevant to their forensic cases.