<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-email-forensics
description: >-
  Email forensic analysis of message headers, MIME structures, phishing
  artifacts, and mailbox databases. Covers Outlook PST/OST parsing,
  Thunderbird mbox analysis, Exchange journal extraction, DKIM/SPF/DMARC
  verification, and email authentication chain reconstruction using
  msconvert, pffexport, and custom header parsing.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - email-forensics
  - pst
  - mbox
  - eml
  - mime
  - dkim
  - spf
  - dmarc
  - phishing-analysis
  - header-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1566.001", "T1566.002", "T1114"]
  nist-csf: ["RS.AN-1", "DE.AE-2"]
  frameworks: ["NIST SP 800-86", "RFC 5322", "RFC 6376"]
---

# Analyzing Email Forensics

## Overview

Email forensics involves the extraction, preservation, and analysis of
email messages to establish communication timelines, identify phishing
campaigns, verify message authenticity, and recover deleted correspondence.
This skill covers header analysis, MIME parsing, PST/OST extraction, and
authentication validation.

## Prerequisites

- Linux forensic workstation with Python 3.10+
- `pffexport` (libpff-utils), `munpack`, `ripmime`
- `readpst` (libpst), `mpack`, `python-email` stdlib
- `opendkim-tools` for DKIM verification

```bash
sudo apt install pff-tools readpst ripmime mpack opendkim-tools
pip install extract-msg olefile
```

## Key Concepts

### Email Format Types

| Format | Extension | Source | Tool |
|--------|-----------|--------|------|
| PST | `.pst` | Outlook (local) | `pffexport`, `readpst` |
| OST | `.ost` | Outlook (cached Exchange) | `pffexport` |
| MBOX | `.mbox` | Thunderbird, Unix mail | Python `mailbox` |
| EML | `.eml` | Individual message | Python `email` |
| MSG | `.msg` | Outlook single message | `extract-msg` |

### Header Forensic Fields

| Header | Forensic Value |
|--------|----------------|
| `Received:` | Mail server hop chain — trace delivery path |
| `Message-ID:` | Unique identifier — detect duplicates/forgery |
| `X-Originating-IP:` | Sender's actual IP (if present) |
| `Authentication-Results:` | SPF/DKIM/DMARC pass/fail |
| `Return-Path:` | Envelope sender — spoofing indicator |
| `X-Mailer:` | Client software — attribution artifact |

## Workflow

### Step 1: Extract Messages from PST/OST

```bash
# Export PST contents to individual EML files
pffexport -m all -t eml evidence.pst
# Output in evidence.pst.export/ directory

# Alternative: readpst for mbox conversion
readpst -o ./mbox_output/ -r evidence.pst

# Extract MSG files
python -c "
import extract_msg
msg = extract_msg.Message('evidence.msg')
print(f'From: {msg.sender}')
print(f'To: {msg.to}')
print(f'Subject: {msg.subject}')
print(f'Date: {msg.date}')
print(f'Body: {msg.body[:500]}')
msg.save(customPath='./extracted/')
"
```

### Step 2: Analyze Email Headers

```bash
# Extract full headers from EML
grep -A 1000 "^$" --max-count=0 evidence.eml | head -1
# Or parse with Python
python3 -c "
import email, email.policy, sys
with open('evidence.eml', 'rb') as f:
    msg = email.message_from_binary_file(f, policy=email.policy.default)
for key in ['From', 'To', 'Subject', 'Date', 'Message-ID',
            'Return-Path', 'X-Originating-IP', 'X-Mailer']:
    print(f'{key}: {msg.get(key, \"N/A\")}')
print('\\n--- Received Chain (newest first) ---')
for r in msg.get_all('Received', []):
    print(f'  {r}')
"

# Trace delivery path — oldest Received header is first hop
grep "^Received:" evidence.eml | tac
```

### Step 3: Verify Email Authentication

```bash
# Check SPF record for sender domain
dig TXT _spf.google.com
dig TXT example.com | grep "v=spf1"

# Verify DKIM signature
opendkim-testmsg < evidence.eml
echo $?  # 0 = pass, non-zero = fail

# Check DMARC policy
dig TXT _dmarc.example.com

# Parse Authentication-Results header
grep -i "Authentication-Results" evidence.eml
```

### Step 4: Extract Attachments and URLs

```bash
# Extract MIME attachments
ripmime -i evidence.eml -d ./attachments/

# Alternative with munpack
munpack evidence.eml

# Extract all URLs from email body
grep -oP 'https?://[^\s"<>]+' evidence.eml | sort -u > urls.txt

# Check attachments for malware indicators
file attachments/*
sha256sum attachments/* > attachment_hashes.txt
# Submit hashes to VirusTotal
```

### Step 5: Bulk Mailbox Analysis

```bash
# Parse mbox file for timeline
python3 -c "
import mailbox, json
mbox = mailbox.mbox('evidence.mbox')
messages = []
for msg in mbox:
    messages.append({
        'from': msg['from'],
        'to': msg['to'],
        'subject': msg['subject'],
        'date': msg['date'],
        'message_id': msg['message-id'],
    })
print(json.dumps(messages[:100], indent=2))
"
```

## Detection

```yaml
title: Email Forensics Detection
id: 67ede347-045f-4419-b0d3-681c15029b30
status: experimental
description: Detects suspicious activity related to analyzing email forensics techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*email*"
  condition: selection
level: medium
tags:
  - attack.t1566.001
  - attack.t1566.002
  - attack.t1114
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] All email containers (PST/OST/MBOX) exported without data loss
- [ ] Header chain analyzed for delivery path anomalies
- [ ] SPF/DKIM/DMARC authentication verified
- [ ] Attachments extracted and hashed
- [ ] URLs extracted and checked against threat intelligence
- [ ] Timeline of communications established
- [ ] Evidence preserved with original headers intact

## References

- [RFC 5322 — Internet Message Format](https://datatracker.ietf.org/doc/html/rfc5322)
- [RFC 6376 — DKIM Signatures](https://datatracker.ietf.org/doc/html/rfc6376)
- [libpff — Personal Folder File Library](https://github.com/libyal/libpff)
- [extract-msg — Outlook MSG Parser](https://github.com/TeamMsgExtractor/msg-extractor)
- [SANS FOR578 — Email Header Analysis](https://www.sans.org/cyber-security-courses/cyber-threat-intelligence/)
