Chapter 8: Email and Messaging Forensics

In the previous chapter, we discussed artifacts related to connectivity and learned how an investigator can leverage such data to understand who a user has been in contact with, how and when network data was used, and what websites the user visited. In this chapter, we will focus on email and messaging forensics.

Any investigation of a mobile device usually includes the search and analysis of messaging artifacts, as they can contain invaluable evidence: emails, text messages, and instant messaging can be used to transmit and receive all kinds of data, such as passwords, notes, confessions, threats, intellectual property, and multimedia files. In this chapter, we will learn where this evidence is stored, what an investigator can expect to find, and how to parse through the artifacts.

We'll begin the chapter with an introduction to email forensics with a focus on the Apple Mail app. We will learn where emails are stored and how to analyze...