Digital Cyber Forensics Contribution for Email Analysis

Abstract

In the past two decades, the Internet has become as open, publicly and widely used as a source of data transmission and exchanging the messages between criminals, terrorists and those who have illegal motivations. Moreover, exchanging important data between various military and financial institutions, even ordinary citizens. From this view, there is one of the important means of exchanging information widely used on the Internet medium is e-mail. Email messages are digital evidence that has been become one of the important means to adopt by courts in many countries and societies as evidence relied upon in condemnation. This paper presents a distinct technique for classifying emails based on data processing and mining, trimming, refinement, and then adapts several algorithms to classify these emails and then using SWARM algorithm to obtain practical and accurate results also using hybrid English lexical dictionary SentiWordNet3.0 for email forensic analysis then deal with a machine learning algorithm. The proposed system is capable of learning in an environment with large and variable data. To test the proposed system, have to select available data which Enron Data set. A high accuracy rate (95%) was obtained, which is higher than the classification rates mentioned in previous research papers presented in section 2 in this paper.

Email Security Issues, Tools, and Techniques Used in Investigation

“…This process is often employed by malicious actors for nefarious purposes, such as sending spam or phishing emails. Email spoofing has several implications, as it can be used to disguise the true source of an email and, consequently, mask its malicious intent [19][20][21][22]. Phishing is a form of cybercrime that employs social engineering and technological deception to obtain bank account identities and passwords [20].…”

“…The analysis will include a detailed examination of the features and functionalities that the tools offer, as well as their associated costs. There are several techniques that are useful for conducting an email investigation during this step, including header investigation, server investigation, investigation of software-embedded details, investigation and discovery of hidden emails, and investigation of anti-forensic activity [20,21]. During the header investigation, the header is critical for inquiry and evidence collecting.…”