Email Headers

From ForensicsWiki
Revision as of 13:24, 21 April 2007 by Jessek (Talk | contribs)

Jump to: navigation, search


Making Sense of Headers

There is no single way to make sense of email headers. Some examiners favor reading from the bottom up, some favor reading from the top down. Because information in the headers can be put there by the user's MUA, a server in transit, or the recipient's MUA, it can be difficult to determine when a line was added.

Mail User Agents

Every MUA sets up the headers for a message slightly differently. Although some headers are required under the applicable RFC, their format and ordering can vary by client. Almost all clients, however, add their headers in a fixed format and order. The examiner can use the format and order for each client to show that messages were forged, but not that they were legitimate. For example, if a message purports to be from Apple Mail but the order or the headers do not match the Apple Mail Header Format, the message has been forged. If the headers of the message do match that format, however, it does not guarantee that the message was sent by that program.

Servers in Transit

Mail servers can add lines onto email headers, usually in the form of "Received" lines, like this:

Received: by (Postfix, from userid 506)
	id 77C30808A; Sat, 24 Feb 2007 20:43:56 -0500 (EST)

Message Id Field

Main article Using message id headers to determine if an email has been forgedAccording to the current guidelines for email [1], every message should have a Message-ID field. These id fields can be used to determine if a message has been forged. It is harder, but sometimes possible, to show that a message is authentic using the message id field. Where known, the Message-ID algorithms for known programs are given on the separate pages for those programs.

Sample Header

This is an (incomplete) excerpt from an email header:

Received: from ( [])
        by (Postfix) with QMQP
Mailing-List: contact; run by ezmlm
Precedence: bulk
List-Id: <>
List-Post: <>
List-Help: <>
List-Unsubscribe: <>
List-Subscribe: <>
Delivered-To: mailing list
Delivered-To: moderator for
From: YJesus <>
Subject: New Tool : Unhide
User-Agent: KMail/1.9
MIME-Version: 1.0
Content-Disposition: inline
Content-Type: text/plain;
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
X-HE-Spam-Level: /
X-HE-Spam-Score: 0.0
X-HE-Virus-Scanned: yes
Status: RO
Content-Length: 586
Lines: 26

External Links