# Identify device Gmail

**URL:** <https://community.metaspike.com/t/identify-device-gmail/1129>\
**Category:** Digital Forensics\
**Created:** [September 27, 2022, 11:11am UTC](https://community.metaspike.com/t/identify-device-gmail/1129 "2022-09-27T11:11:56Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [September 27, 2022, 4:40pm UTC](https://community.metaspike.com/t/identify-device-gmail/1129/2 "2022-09-27T16:40:16Z")

</div>

Some data points you can use to identify the sender’s email client are the MIME boundary delimiter, Message-ID, Content-IDs, and quote strings. Quote strings can sometimes help identify the email clients that were used to compose previous messages in the email thread as well.

As you mentioned, trace headers may also contain clues. For instance, they may contain references to the transport that was used such as MAPI, which would help narrow things down.

We had a relevant discussion here:

> [@How to Determine Email Client](https://community.metaspike.com/t/how-to-determine-email-client/119):
>
> Hello, I am investigating emails from several Gmail accounts and trying to determine if they were sent using an email client such as Outlook, from [Gmail.com](http://Gmail.com) on the web or by using a cell phone. Would the email headers contain this information? Any suggestions would be greatly appreciated.

For reference, here is what FEI does with that information on a simple sample message. This message did not have transport or Content-ID evidence, but you can see how the Message-ID, MIME boundary, and quote string evidence are used toward client identification.

 ![sample](https://community.metaspike.com/uploads/default/original/1X/5cd26ebb8a33c386f73c093e06e71e3f020cbd35.jpeg)

---

_[View the full topic](https://community.metaspike.com/t/identify-device-gmail/1129)._
