Identify device Gmail

[jonas.virdegard (Jonas Virdegård)]

Hi

Is it possible to identify the device from which mail has been sent? Applies to Gmail. Something in the routing information that might provide traces? There are no X-mailers or orginated IPnumber in the tests i have.

All suggestions are gratefully received!

Thanks

Jonas Virdegård
Swedish Tax Agency

[agungor (Arman Gungor)]

Some data points you can use to identify the sender’s email client are the MIME boundary delimiter, Message-ID, Content-IDs, and quote strings. Quote strings can sometimes help identify the email clients that were used to compose previous messages in the email thread as well.

As you mentioned, trace headers may also contain clues. For instance, they may contain references to the transport that was used such as MAPI, which would help narrow things down.

We had a relevant discussion here:

How to Determine Email Client

Hello, I am investigating emails from several Gmail accounts and trying to determine if they were sent using an email client such as Outlook, from Gmail.com on the web or by using a cell phone. Would the email headers contain this information? Any suggestions would be greatly appreciated.

For reference, here is what FEI does with that information on a simple sample message. This message did not have transport or Content-ID evidence, but you can see how the Message-ID, MIME boundary, and quote string evidence are used toward client identification.