Summary

In this chapter, we have gone over standard email protocols: the system uses SMTP to send emails, while POP and IMAP are used to receive emails. IMAP also includes features that the user can use to manage the inbox. We went over the email header and the components that make up the header. We also discussed WebMail and email clients.

You now have the skills necessary to read an email header and determine the servers that the user used to transmit the email and what protocols the system used to send and receive the email. When conducting a digital forensic examination, you can now identify artifacts from typical email clients and web-based emails.

In the next chapter, you will learn about the similarities between web-based email clients.