Hotmail Forensics – In Depth Hotmail Forensics Explained

Hotmail Forensics Need Of The Hour

Since, Hotmail has become one of the most widely used web – based email service, therefore, with increasing boom, it has also become a victim of various email crimes such as cyber bullying, child pornography, email spoofing and many more. As Hotmail is not compatible with IMAP, therefore, one of the most emerging challenges of the investigators is to perform a forensic investigation of the complete set of available email folders in addition to inbox.

One of the most peculiar features possessed by Hotmail (as well as other web – based email services) is that it stores loads of data on the computer.

Forensic Analysis of Hotmail Email Accounts Simplified & Postulated

Digging into the anatomy of Hotmail, it has been inferred that by default, the IP address of the sending machine that has sent the email via Hotmail, gets entrapped. Many other such attributes of Hotmail pave a way for forensic investigators to carve out necessary required evidence. The corporate as well as the law enforcement forensic examiners rely on the email evidence that is available on the computer after the execution of crime, i.e., during post crime investigation.

Tracing a Hotmail Email

During Hotmail forensics, Hotmail emails can be traced by following the below mentioned steps: -

Select the suspect email.
Right click on the email and choose View message source option. The complete message header of the email will now appear in the window. As already mentioned, the IP address of the machine via which the email is being sent is entrapped by Hotmail, this IP address is fetched and added to the email header.
Observe the following field: -
X-Originating-IP: [ab.xyz.mno.pq]
The above mentioned field provides the required IP address.

Obscuring the Hotmail Email Headers

Certain peculiar attributes that need to be checked out during the investigation of the Hotmail email header involve open relay, open proxy, use of anonymizer, etc.

Open relay: - This technique is primarily used by the investigators to hide the original IP address of the sender.But the originating IP address gets saved within the transaction log section of the open relay log files.
Anonymizers: - were built for the purpose of facilitating the forensic investigators in investigations. But eventually it has become a curse for the experts. However, detailed analysis proves that within the log files of anonymizers, the originating IP address gets trapped.

Manual Approach

One of the most common and frequently used approach by Forensicators for investigating emails is with the usage of Microsoft Outlook and Hotmail Connector. As Microsoft Outlook stores all its user account data within Outlook Data File, i.e. PST forensic investigation of these PST files is now possible up to a very much extent. Hotmail Connector is required for configuring the hotmail account with Microsoft Outlook email client as Hotmail is not compatible with IMAP settings. Or Alternatively you can take backup of hotmail emails in your computer in any email file type using a suitable third party tool.

Looking For An Independent Hotmail Forensics Solution

For detailed forensic investigation of hotmail emails, or other web – based emailing services, Mailxaminer can be taken into account. The software is loaded with sophisticated search algorithms that allow investigators to dig into the emails for carving evidence.

In addition to this, the tool can be used on all the available versions of Windows OS. Get acquainted with the humongous features available in the tool that makes Hotmail forensics a piece of cake.