Subject: Digital Forensics

Topic: Network Forensics

Difficulty: High

For many e-mail investigations, we can rely on e-mail message files, e-mail headers, and e-mail server log files.

Tools, such as the ones in the following list, are specifically created for e-mail recovery, including recovering deleted attachments from a hard drive:

DataNumen for Outlook and Outlook Express

FINALeMAIL for Outlook Express and Eudora

Sawmill-GroupWise for log analysis

DBXtract for Outlook Express

Fookes Aid4Mail and MailBag Assistant for Outlook, Thunderbird, and Eudora

Paraben E-Mail Examiner, configured to recover several e-mail formats

Access Data FTK for Outlook and Outlook Express

Ontrack Easy Recovery Email Repair for Outlook and Outlook Express

R-Tools R-Mail for Outlook and Outlook Express

Office Recovery’s Mail Recovery for Outlook, Outlook Express, Exchange, Exchange Server, and IBM LotusNotes