Email harassment can be a form of stalking. If someone sends consistent, unwanted, and at times threatening electronic messages to someone then this is considered email harassment. If the recipient of the email finds the email to be offensive, or harmful, this it is also considered email harassment. Some states have very strict rules when it comes to email harassment. Email harassment can come from a domestic dispute, inappropriate joke, discrimination and etc.
To investigate email harassment, it is important to know how an email server records and handles emails. Some email servers, use databases that store user emails and others use a flat file system. After it has been determined that an email crime has been committed involving an email, the first step is to access the victims computer and recover the evidence. Using the victims email client, you must find and copy any potential evidence. It is important to copy, print, or forward the email to another email address as a backup.
After an email messages is copied, you will then need to find the email header, after the email header is found, open the email header and copy and paste that information into a text comment so that it can be read as a text editor. The next step is to examine the email header to gather information about the email and track the suspect’s emails original location. Operand, Deed (2008) The IP or domain address is another important piece of important information to look for when investigating. An IP address can help you locate the suspect and its location.
It is important to know how an email server works, records, and handle emails. The focus is not to know everything about the server, but at least know how to retrieve information about the emails that you are investigating. Some email servers use databases that store user emails an others use a flat file system. Operand, Deed (2008) After the source of email is identified, it is important to contact the network administrator right away. This is important because administrator keep logs of email information and each administration have it own cutoff times as to when the logs are deleted.
This information can be crucial in an investigation. Some email servers don’t completely delete messages until the system has been backed up. But with some systems, an email administrator may have to recover the entire server to retrieve one deleted message. For the servers that don’t completely delete the messages until the system has been backed up, some administrators may be able to still recover these emails if you have a date and time stamp. Operand, Deed (2008) Exchange server is a Microsoft email server.
Exchange uses a database that is based on Microsoft Extensible Storage Engine (SEES), which uses several files in different combinations to provide email service. Exchange logs information about changes to its data called transactions. Administrators prevent loss of data from their most recent backup by using a checkpoint file or marker. A checkpoint file or marker is inserted in the transaction log which marks the last point at which the database was written to disk. Administrator can request lost or deleted messages using this method.
There are many ways that Microsoft can recover messages. Exchange servers can also maintain a log called tracking. Log that tracks messages. Novel Groupies is used as the email service for a lot of large organizations. Novel Groupies stores messages in up to 25 proprietary databases. Groupies supports emails, calendaring, personal information management, instant messaging and document management. This database is similar to how exchange works. Groupies has two ways to organize mailboxes on their server.
The permanent index files aka ids extension are updated and renamed at the end of the day which allows mailboxes to remain in order. Groupies(2014) There are many ways to recover email messages files, headers and server log files with the help of an email administrator. However, an email administrator may not always be available or willing to help with the investigation. If this is the case, there are several data recovery tools and forensic tools available to assist n recovering these email files.
They can recover deleted files including those removed from recycle bin, recover mailboxes, folders, individual messages from Sharpening databases and recover tables from offline or corrupted databases and database rebuild and modification. This product will allow you to use a demo before actually purchasing the product, but pricing has to be negotiated with a sales rep. Stools (2014) Foes tools is another set of popular tools used to help aide in an email investigation. Foes was founded in 1996 and is based in Chancy Switzerland. Foes tools include Admiral, Notated, and easy thumbnails.
Admiral has been recognized as the most accurate email import/export solution on the market, Admiral supports Outlook 201 3, MAP and website accounts such as Gamma, yahoo, and others. Notated is a text, and HTML editor that can work on multiple files and carryout system wide searches and multi-line replacements. Admiral pricing starts at $19. 96 and Notated 7. 1 starts at $39. 95. CENT (2014) Data Recovery tools can have many advantages. One of the major advantages is that you don’t need to know how the email server or client operates to extract data from these computers.
Data recovery tools can do all this work for you. One of the most important pieces in an email investigation is to ensure that you move swiftly. Some systems keep a backup of the emails on their servers and others don’t. In order to ensure you have all the information needed it is very important to work with the Network administrator. If the administrator isn’t available, then there are data recovery tools that are available to assist you. It is important to have some sort of knowledge about the tools and the email server that you are working with in order to have a positive investigation.
