Email forensics for law enforcement authorities
In proceedings involving fraud, extortion, identity misuse or data exfiltration, an email is often the central piece of evidence. Whether it is authentic, where it was submitted and which path it took can be established from headers, signatures and server logs. I support public prosecutors, police and other authorities with technical analyses and written reports that non-technical readers can follow.
- Email Forensics
- Header Analysis
- DKIM Verification
- Exchange & Microsoft 365
- Criminal Proceedings
- Expert Reports
Services
- Origin analysisEvaluate the Received chain, submitting IP addresses, mail servers and timestamps; clearly separate reliable header fields from forgeable ones.
- Authenticity verificationVerify DKIM signatures after the fact, put SPF and DMARC results into context, detect manipulation of content or headers.
- Log and platform analysisExchange message tracking, Message Trace and audit logs from Microsoft 365, gateway logs: reconstruct delivery, forwarding and access.
- Compromised accountsDetermine whether and since when a mailbox was taken over and which messages the attacker sent, read or deleted.
- Report and explanationWritten report with method, findings and limits of the conclusions; explanation to investigators and the court.
Method and evidential value
Analysis is performed on copies of the secured data, never on the originals; hash values prove that the copies are unchanged. Header analysis uses tools that work locally, so evidence does not leave the controlled environment. Every step is documented so that another expert can repeat it. The report separates findings, interpretation and open questions; anything the data cannot substantiate is stated as such. Engagements are possible as an expert under Art. 182 ff. of the Swiss Criminal Procedure Code (CrimPC) as well as technical support for ongoing investigations.
How an engagement runs
- Mandate and questionsThe authority formulates the questions; scope, deadlines and the form of data handover are defined.
- Data handoverCopies with hash values, documented handover and secure storage.
- AnalysisEvaluate headers, signatures and logs, substantiate findings with the raw data.
- ReportAnswers to the questions asked, method and limits of the conclusions, oral explanation if required.
Real-world examples
- Header Analyzer: analyzes email headers locally in the browser, without upload.
- MailHeaderAnalyzer for PowerShell: header analysis without network access, suitable for isolated analysis environments.
- compauth in Microsoft 365: how Microsoft assesses the authenticity of a sender, with all reason codes.
- AuthMechanism 10 and AuthAs Internal: how Exchange classifies message submission in the header.
- Internal or external?: classifying Exchange hybrid mail by its header.
