The he-said-she-said game is often thrown out the window once computer evidence is added to the fray. The email plays a major role in most types of investigations. The email evidence extends to both business and personal devices, as it is widely used to send files, communicate with peers, and to receive notifications from online services. By examining email, we can learn what social media, cloud storage, or other sites are used by the custodian. We can also look for data exfiltration outside of an organization or investigate the source of a phishing scheme.
This chapter will cover recipes that expose this information for investigations, including:
- Reading the EML format using built-in libraries
- Leveraging the win32com library to extract information from Outlook MSG files
- Preserving Google Gmail with Takeouts and parsing the preservation
- Using built-in libraries to...
