# Digital Forensics **URL:** https://community.metaspike.com/c/digital-forensics/6.md?page=1 [Latest](https://community.metaspike.com/latest.md) · [Categories](https://community.metaspike.com/categories.md) · [Tags](https://community.metaspike.com/tags.md) **Page:** 2 --- ## [Time stamp forgery detection](https://community.metaspike.com/t/time-stamp-forgery-detection/592)
**Author:** [@technoviking](https://community.metaspike.com/u/technoviking)\ **Replies:** 5\ **Last updated:** [January 21, 2023, 6:44pm UTC](https://community.metaspike.com/t/time-stamp-forgery-detection/592 "2023-01-21T18:44:47Z")
If given .docx and .pdf files without underlying access to the filesystem created on, (hfs) is it possible to detect forged timestamps, or anything within the file itself that would give an indication? Thank you. --- ## [Google Drive Versions Pull](https://community.metaspike.com/t/google-drive-versions-pull/1242)
**Author:** [@ysorokin](https://community.metaspike.com/u/ysorokin)\ **Replies:** 4\ **Last updated:** [December 20, 2022, 2:42am UTC](https://community.metaspike.com/t/google-drive-versions-pull/1242 "2022-12-20T02:42:37Z")
Is there a tool or some method to acquire Google Drive documents and their versions? I know we can grab documents as attachments but was wondering if there is a way to do it without emailing links --- ## [Message ID and hidden dates](https://community.metaspike.com/t/message-id-and-hidden-dates/1009)
**Author:** [@CAForense](https://community.metaspike.com/u/CAForense)\ **Replies:** 7\ **Last updated:** [December 5, 2022, 6:34pm UTC](https://community.metaspike.com/t/message-id-and-hidden-dates/1009 "2022-12-05T18:34:32Z")
Hi All- I’m on an investigation and trying to identify if the following message-id “0877a7ba8b67721b6b521d55b5fbfa795f5d8d8e85941b6fdbd02fac943b411” has hidden dates. Does anyone know if this format has them? and, if so… --- ## [Certificate Attributes in Email Sender](https://community.metaspike.com/t/certificate-attributes-in-email-sender/1229)
**Author:** [@ZeroDayChill](https://community.metaspike.com/u/ZeroDayChill)\ **Replies:** 1\ **Last updated:** [November 25, 2022, 4:07pm UTC](https://community.metaspike.com/t/certificate-attributes-in-email-sender/1229 "2022-11-25T16:07:13Z")
Hi there, I’m working a matter whereby I’m trying to tie the suspect to the keyboard for a BEC type case. I’ve located the suspicious emails being generated and sent in the Custodian’s OST file, however I am seeing a di… --- ## [Identify device Gmail](https://community.metaspike.com/t/identify-device-gmail/1129)
**Author:** [@jonas.virdegard](https://community.metaspike.com/u/jonas.virdegard)\ **Replies:** 1\ **Last updated:** [September 27, 2022, 4:40pm UTC](https://community.metaspike.com/t/identify-device-gmail/1129 "2022-09-27T16:40:16Z")
Hi Is it possible to identify the device from which mail has been sent? Applies to Gmail. Something in the routing information that might provide traces? There are no X-mailers or orginated IPnumber in the tests i have. … --- ## [Identify suspect from email](https://community.metaspike.com/t/identify-suspect-from-email/1102)
**Author:** [@caseyl4n6](https://community.metaspike.com/u/caseyl4n6)\ **Replies:** 1\ **Last updated:** [September 16, 2022, 6:04pm UTC](https://community.metaspike.com/t/identify-suspect-from-email/1102 "2022-09-16T18:04:30Z")
We are working a case and need to identify an anonymous suspect. If we reach out via email or social DMs, could we make them reveal identifying info like IP, device details and such? --- ## [Corrupted "Received"](https://community.metaspike.com/t/corrupted-received/1092)
**Author:** [@sfjd](https://community.metaspike.com/u/sfjd)\ **Replies:** 1\ **Last updated:** [September 9, 2022, 4:17pm UTC](https://community.metaspike.com/t/corrupted-received/1092 "2022-09-09T16:17:29Z")
I downloaded a suspect email from 163.com webmail as .eml, which could not be analyzed successfully in FEI. This may result from a corrupted header below. Received: from TY2PR03MB4621.apcprd03.prod.outlook.com (\[fe80:… --- ## [Using Symbolic Links to Map Folder Paths for DFIR / eDiscovery Tools](https://community.metaspike.com/t/using-symbolic-links-to-map-folder-paths-for-dfir-ediscovery-tools/1075)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [August 24, 2022, 7:25pm UTC](https://community.metaspike.com/t/using-symbolic-links-to-map-folder-paths-for-dfir-ediscovery-tools/1075 "2022-08-24T19:25:19Z")
This question came up recently in the context of ingesting FEC projects that have been moved from their original folder structure into FEI. It also applies to virtually any DFIR / eDiscovery scenario where the path to th… --- ## [Velociraptor Demo](https://community.metaspike.com/t/velociraptor-demo/999)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [June 21, 2022, 8:31pm UTC](https://community.metaspike.com/t/velociraptor-demo/999 "2022-06-21T20:31:56Z")
You have probably seen Velociraptor mentioned in the Community before in the context of collecting state information from hosts, even collecting local email data. I came across this presentation on the weekend from Eric… --- ## [Email Collection From Multiple Computers](https://community.metaspike.com/t/email-collection-from-multiple-computers/972)
**Author:** [@caseyl4n6](https://community.metaspike.com/u/caseyl4n6)\ **Replies:** 1\ **Last updated:** [June 14, 2022, 6:49pm UTC](https://community.metaspike.com/t/email-collection-from-multiple-computers/972 "2022-06-14T18:49:58Z")
I have to come up with a plan to collect emails from many computers (maybe 30 to 40?) for an onsite inspection, only within a date range. Not allowed to make full forensic images. Anyone have suggestions? Could I use rob… --- ## [O365 linked attachments](https://community.metaspike.com/t/o365-linked-attachments/594)
**Author:** [@Yaniv\_Schiff](https://community.metaspike.com/u/Yaniv_Schiff)\ **Replies:** 1\ **Last updated:** [May 26, 2022, 9:24pm UTC](https://community.metaspike.com/t/o365-linked-attachments/594 "2022-05-26T21:24:12Z")
Does anyone know of a way to download and maintain the relationship between O365 email and OneDrive linked attachments. Similar to how FEC handles Google Drive attachments but for O365. --- ## [Hotmail/personal outlook and recoverable items\\purges](https://community.metaspike.com/t/hotmail-personal-outlook-and-recoverable-items-purges/907)
**Author:** [@Azad](https://community.metaspike.com/u/Azad)\ **Replies:** 3\ **Last updated:** [April 27, 2022, 3:17pm UTC](https://community.metaspike.com/t/hotmail-personal-outlook-and-recoverable-items-purges/907 "2022-04-27T15:17:18Z")
I have noticed when collecting data from Hotmail accounts that there is a recoverable items root\\purges folder. As I understand it this is used for litigation hold matters on a M365 business account. Is this a lazy arch… --- ## [Continuing Professional Education Tracker](https://community.metaspike.com/t/continuing-professional-education-tracker/870)
**Author:** [@nnn](https://community.metaspike.com/u/nnn)\ **Replies:** 3\ **Last updated:** [March 23, 2022, 1:08am UTC](https://community.metaspike.com/t/continuing-professional-education-tracker/870 "2022-03-23T01:08:34Z")
Is there a vendor/portal that can help track and monitor CPE’s for the year? I have CPE’s from SANS, others from McAfee Institute and wanted to see what is the best way to keep track of them. --- ## [Computer time change record in MAc](https://community.metaspike.com/t/computer-time-change-record-in-mac/774)
**Author:** [@jameshardy12345](https://community.metaspike.com/u/jameshardy12345)\ **Replies:** 0\ **Last updated:** [December 5, 2021, 6:44pm UTC](https://community.metaspike.com/t/computer-time-change-record-in-mac/774 "2021-12-05T18:44:47Z")
Is it possible to check the record of when a Mac computer’s dates were changed and what will be the best way to delete those if required? Thanks --- ## [X-MimeOLE domain](https://community.metaspike.com/t/x-mimeole-domain/763)
**Author:** [@sfjd](https://community.metaspike.com/u/sfjd)\ **Replies:** 1\ **Last updated:** [November 12, 2021, 6:03pm UTC](https://community.metaspike.com/t/x-mimeole-domain/763 "2021-11-12T18:03:18Z")
I obversed that certain email in different dbx/pst backups had different X-MimeOLE domains. e.g. X-Mailer: Microsoft Outlook Express 6.00.2900.3138 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512 and X-M… --- ## [How to Determine Email Client](https://community.metaspike.com/t/how-to-determine-email-client/119)
**Author:** [@Jtylor](https://community.metaspike.com/u/Jtylor)\ **Replies:** 5\ **Last updated:** [November 12, 2021, 10:32am UTC](https://community.metaspike.com/t/how-to-determine-email-client/119 "2021-11-12T10:32:24Z")
Hello, I am investigating emails from several Gmail accounts and trying to determine if they were sent using an email client such as Outlook, from Gmail.com on the web or by using a cell phone. Would the email headers c… --- ## [GSuite extract emails and save copy of mbox as Admin without knowing users password?](https://community.metaspike.com/t/gsuite-extract-emails-and-save-copy-of-mbox-as-admin-without-knowing-users-password/232)
**Author:** [@nnn](https://community.metaspike.com/u/nnn)\ **Replies:** 11\ **Last updated:** [September 15, 2021, 2:05pm UTC](https://community.metaspike.com/t/gsuite-extract-emails-and-save-copy-of-mbox-as-admin-without-knowing-users-password/232 "2021-09-15T14:05:25Z")
GSuite extract emails and save copy of mbox as Admin without knowing users password? Is it possible? --- ## [Trusted Timestamping (RFC 3161) in Digital Forensics](https://community.metaspike.com/t/trusted-timestamping-rfc-3161-in-digital-forensics/717)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [August 17, 2021, 9:39pm UTC](https://community.metaspike.com/t/trusted-timestamping-rfc-3161-in-digital-forensics/717 "2021-08-17T21:39:05Z")
Hello everyone, Just published a new blog on trusted timestamping which goes hand in hand with some of FEC’s new functionality :smiley: Check it out below! --- ## [Check iPhone for Pegasus](https://community.metaspike.com/t/check-iphone-for-pegasus/704)
**Author:** [@caseyl4n6](https://community.metaspike.com/u/caseyl4n6)\ **Replies:** 3\ **Last updated:** [July 27, 2021, 4:00pm UTC](https://community.metaspike.com/t/check-iphone-for-pegasus/704 "2021-07-27T16:00:38Z")
Hello, We need to scan a clients iphone for Pegasus. What is the quickest way to handle this? --- ## [MBR hex analysis](https://community.metaspike.com/t/mbr-hex-analysis/690)
**Author:** [@CB\_84](https://community.metaspike.com/u/CB_84)\ **Replies:** 0\ **Last updated:** [July 2, 2021, 3:56pm UTC](https://community.metaspike.com/t/mbr-hex-analysis/690 "2021-07-02T15:56:53Z")
Hi, Is there anyone that would know why the hex is displayed in the pattern shown in the picture? I’m not sure what it is? It’s showing the hex from the first two sectors from a Linux MBR. Thanks! --- ## [Oversize email transmission](https://community.metaspike.com/t/oversize-email-transmission/685)
**Author:** [@technoviking](https://community.metaspike.com/u/technoviking)\ **Replies:** 1\ **Last updated:** [June 8, 2021, 7:35pm UTC](https://community.metaspike.com/t/oversize-email-transmission/685 "2021-06-08T19:35:11Z")
If an email is over the limits of the connected email service, is it possible that an email client could potentially still transmit the email in its entirety to the email server before is is then rejected by said email s… --- ## [Dates in Hiding Part 2—Gmail MIME Boundary Timestamps](https://community.metaspike.com/t/dates-in-hiding-part-2-gmail-mime-boundary-timestamps/288)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 2\ **Last updated:** [March 30, 2020, 3:34pm UTC](https://community.metaspike.com/t/dates-in-hiding-part-2-gmail-mime-boundary-timestamps/288 "2020-03-30T15:34:45Z")
This post on Gmail MIME boundary timestamps is an update to my previous Dates in Hiding post to cover some recent developments. Special thanks to @stigarve.hopland for his contributions! --- ## [Dkimpy tool always fails agains EML exported from Outlook](https://community.metaspike.com/t/dkimpy-tool-always-fails-agains-eml-exported-from-outlook/680)
**Author:** [@KaremAli](https://community.metaspike.com/u/KaremAli)\ **Replies:** 1\ **Last updated:** [May 28, 2021, 2:36pm UTC](https://community.metaspike.com/t/dkimpy-tool-always-fails-agains-eml-exported-from-outlook/680 "2021-05-28T14:36:16Z")
I installed dkimpy 1.0.5 with python 3 and I found that always it fails against EML exported from outlook because body hash is not correct. when I sent the same message to gmail client and outlook client I found that ou… --- ## [Attachment too big error message specifies different size between clients](https://community.metaspike.com/t/attachment-too-big-error-message-specifies-different-size-between-clients/665)
**Author:** [@technoviking](https://community.metaspike.com/u/technoviking)\ **Replies:** 1\ **Last updated:** [May 6, 2021, 4:50pm UTC](https://community.metaspike.com/t/attachment-too-big-error-message-specifies-different-size-between-clients/665 "2021-05-06T16:50:07Z")
When you try to attach a file above the outlook.com limit the client will warn with a message such as “the email message cannot be sent because it exceeds the 35MB outgoing message size limit” I have noted windows mail … --- ## [Investigating Message Read Status in Gmail & Google Workspace](https://community.metaspike.com/t/investigating-message-read-status-in-gmail-google-workspace/649)
**Author:** [@agungor](https://community.metaspike.com/u/agungor)\ **Replies:** 0\ **Last updated:** [April 2, 2021, 4:59pm UTC](https://community.metaspike.com/t/investigating-message-read-status-in-gmail-google-workspace/649 "2021-04-02T16:59:55Z")
Just published a quick post to lay out three investigative techniques we can use to determine historical message read status in Gmail and Google Workspace. --- ## [VM for Email Forensics](https://community.metaspike.com/t/vm-for-email-forensics/618)
**Author:** [@Ryan\_Ng](https://community.metaspike.com/u/Ryan_Ng)\ **Replies:** 5\ **Last updated:** [March 6, 2021, 1:40am UTC](https://community.metaspike.com/t/vm-for-email-forensics/618 "2021-03-06T01:40:54Z")
Are there any VM that you recommend that has the appropriate tools to analyze malicious emails? (anyone or @agungor) I have some experience with SANS SIFT and REMnux. Thanks! --- ## [Header of attached email](https://community.metaspike.com/t/header-of-attached-email/602)
**Author:** [@technoviking](https://community.metaspike.com/u/technoviking)\ **Replies:** 2\ **Last updated:** [February 10, 2021, 10:41pm UTC](https://community.metaspike.com/t/header-of-attached-email/602 "2021-02-10T22:41:40Z")
Hello, Below is an example from within an eml file of an attachment header of an attached .msg email, the email it is attached to was sent 24 Jun 2018 : Content-Type: message/rfc822 Content-Disposition: attachment; … --- ## [Hidden Timestamps](https://community.metaspike.com/t/hidden-timestamps/474)
**Author:** [@technoviking](https://community.metaspike.com/u/technoviking)\ **Replies:** 6\ **Last updated:** [February 7, 2021, 12:30pm UTC](https://community.metaspike.com/t/hidden-timestamps/474 "2021-02-07T12:30:02Z")
I have read the very nice article on hidden timestamps in emails. Do all mime type delimiters have timestamps, andis this a format that anyone has come across? Content-type: multipart/mixed; boundary="B\_nnnnnnnnnn\_nnn… --- ## [SharePoint extraction tool](https://community.metaspike.com/t/sharepoint-extraction-tool/554)
**Author:** [@nnn](https://community.metaspike.com/u/nnn)\ **Replies:** 5\ **Last updated:** [February 5, 2021, 4:24pm UTC](https://community.metaspike.com/t/sharepoint-extraction-tool/554 "2021-02-05T16:24:53Z")
question. tool to extract files/libraries from SharePoint on back-end --- ## [Email sent date](https://community.metaspike.com/t/email-sent-date/578)
**Author:** [@technoviking](https://community.metaspike.com/u/technoviking)\ **Replies:** 1\ **Last updated:** [January 25, 2021, 5:17pm UTC](https://community.metaspike.com/t/email-sent-date/578 "2021-01-25T17:17:15Z")
If a sent email is provided in eml format, and the same email is provided again at a later date but from a different source computer having being imported from the original computer, is there any reason why the sent date… [Previous page](https://community.metaspike.com/c/digital-forensics/6.md) [Next page](https://community.metaspike.com/c/digital-forensics/6.md?page=2)