Understanding client-based email analysis
A user has access to many email clients to retrieve, read, and send emails. Depending on whether you’re in the consumer or commercial environment, you may encounter different email clients. In the consumer market, you will find that Microsoft Outlook/Outlook Express will prevail because it is preinstalled on the system. In addition, Microsoft Outlook comes with the Microsoft Office suite. There are also freeware options available such as the Thunderbird email client.
You can conduct an email examination by exporting the container used by the client and opening it with the email client installed on your forensic computer. Another option is to utilize specialized commercial forensic software created for email examinations. The more common forensic suites will typically analyze the more common email client containers.
We will discuss some more common email clients in the following sections.
