In f r a s t r u c t u r e s N e t w o r k in gX - M S M a il- P r io r it y : N o r m a l X - M a...

10
Digital Investigator Networking Infrastructures SMTP, POP-3 and IMAP

Transcript of In f r a s t r u c t u r e s N e t w o r k in gX - M S M a il- P r io r it y : N o r m a l X - M a...

Page 1: In f r a s t r u c t u r e s N e t w o r k in gX - M S M a il- P r io r it y : N o r m a l X - M a ile r : M ic r o s o f t O u t lo o k E x p r e s s 6 .0 0 .3 7 9 0 .3 9 5 9 X -

DigitalInvestigator

Networking

Infrastructures

SMTP, POP-3 and IMAP

Page 2: In f r a s t r u c t u r e s N e t w o r k in gX - M S M a il- P r io r it y : N o r m a l X - M a ile r : M ic r o s o f t O u t lo o k E x p r e s s 6 .0 0 .3 7 9 0 .3 9 5 9 X -

Author: Prof Bill Buchanan

Ne

t F

ore

ns

ics

SMTP

Page 3: In f r a s t r u c t u r e s N e t w o r k in gX - M S M a il- P r io r it y : N o r m a l X - M a ile r : M ic r o s o f t O u t lo o k E x p r e s s 6 .0 0 .3 7 9 0 .3 9 5 9 X -

SM

TP

Ne

t F

ore

nsic

s

Author: Prof Bill Buchanan

Email Architecture

Email gateway

- SMTP.

- MS Mail.

Email Server

· - Post Office

· - Email database

Email client

Page 4: In f r a s t r u c t u r e s N e t w o r k in gX - M S M a il- P r io r it y : N o r m a l X - M a ile r : M ic r o s o f t O u t lo o k E x p r e s s 6 .0 0 .3 7 9 0 .3 9 5 9 X -

SM

TP

Ne

t F

ore

nsic

s

Author: Prof Bill Buchanan

SMTP

HELO domain

250 OK

MAIL FROM: fred@home

250 OK

RCPT TO: bert@home

250 OK

MESSAGE

354

DATA

.

250 OK

Email gateway

- SMTP (TCP: 25/465/587)

- MS Mail.

Page 5: In f r a s t r u c t u r e s N e t w o r k in gX - M S M a il- P r io r it y : N o r m a l X - M a ile r : M ic r o s o f t O u t lo o k E x p r e s s 6 .0 0 .3 7 9 0 .3 9 5 9 X -

SM

TP

Ne

t F

ore

nsic

s

Author: Prof Bill Buchanan

SMTP

Email gateway

- SMTP (TCP: 25/465/587)

- MS Mail.

220 napier Microsoft ESMTP MAIL Service, Version: 6.0.3790.3959 ready at

Mon, 11 Mar 2013 22:06:28 +0000

EHLO napier

250-napier Hello [192.168.0.12]

250-TURN

250-SIZE 2097152

250-ETRN

250-PIPELINING

250-DSN

250-ENHANCEDSTATUSCODES

250-8bitmime

250-BINARYMIME

250-CHUNKING

250-VRFY

250 OK

MAIL FROM: <[email protected]>

250 2.1.0 [email protected] OK

RCPT TO: <[email protected]>

250 2.1.5 [email protected]

DATA

354 Start mail input; end with <CRLF>.<CRLF>

Message-ID: <327D7B5223214259B3756468AFF23AAE@napier>

From: "Fred Smith" <[email protected]>

To: <[email protected]>

Subject: Test

Date: Mon, 11 Mar 2013 22:10:34 -0000

MIME-Version: 1.0

Content-Type: text/plain;

.format=flowed;

.charset="iso-8859-1";

.reply-type=original

Content-Transfer-Encoding: 7bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.3790.3959

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.3959

.

250 2.6.0 <327D7B5223214259B3756468AFF23AAE@napier> Queued mail for

delivery

QUIT

221 2.0.0 napier Service closing transmission channel

Page 6: In f r a s t r u c t u r e s N e t w o r k in gX - M S M a il- P r io r it y : N o r m a l X - M a ile r : M ic r o s o f t O u t lo o k E x p r e s s 6 .0 0 .3 7 9 0 .3 9 5 9 X -

Author: Prof Bill Buchanan

Ne

t F

ore

ns

ics

IMAP 4

Page 7: In f r a s t r u c t u r e s N e t w o r k in gX - M S M a il- P r io r it y : N o r m a l X - M a ile r : M ic r o s o f t O u t lo o k E x p r e s s 6 .0 0 .3 7 9 0 .3 9 5 9 X -

IMA

PN

et F

ore

nsic

s

Author: Prof Bill Buchanan

IMAP 4

Email server

- IMAP 4 (RFC 3501). TCP: 143/993

- POP-3. TCP 110/993

- Exchange.

>> * OK IMAP4rev1 Service Ready

a001 login mrc secret

>> a001 OK LOGIN completed

a002 select inbox

>> * 18 EXISTS

>> * FLAGS (\Answered \Flagged \Deleted \Seen \Draft)

>> * 2 RECENT

>> * OK [UNSEEN 17] Message 17 is the first unseen message

>> * OK [UIDVALIDITY 3857529045] UIDs valid

>> a002 OK [READ-WRITE] SELECT completed

a003 fetch 12 full

>> * 12 FETCH (FLAGS (\Seen) INTERNALDATE "17-Jul-1996 02:44:25 -0700"

RFC822.SIZE 4286 ENVELOPE ("Wed, 17 Jul 1996 02:23:25 -0700 (PDT)"

"IMAP4rev1 WG mtg summary and minutes"

(("Terry Gray" NIL "gray" "cac.washington.edu"))

(("Terry Gray" NIL "gray" "cac.washington.edu"))

(("Terry Gray" NIL "gray" "cac.washington.edu"))

((NIL NIL "imap" "cac.washington.edu"))

((NIL NIL "minutes" "CNRI.Reston.VA.US")

("John Klensin" NIL "KLENSIN" "MIT.EDU")) NIL NIL

"<[email protected]>")

BODY ("TEXT" "PLAIN" ("CHARSET" "US-ASCII") NIL NIL "7BIT" 3028

92))

>> a003 OK FETCH completed

a004 fetch 12 body[header]

>> * 12 FETCH (BODY[HEADER] {342}

>> Date: Wed, 17 Jul 1996 02:23:25 -0700 (PDT)

>> From: Terry Gray <[email protected]>

>> Subject: IMAP4rev1 WG mtg summary and minutes

>> To: [email protected]

>> cc: [email protected], John Klensin <[email protected]>

>> Message-Id: <[email protected]>

>> MIME-Version: 1.0

>> Content-Type: TEXT/PLAIN; CHARSET=US-ASCII

>>

>> )

>> a004 OK FETCH completed

a005 store 12 +flags \deleted

>> * 12 FETCH (FLAGS (\Seen \Deleted))

>> a005 OK +FLAGS completed

a006 logout

>> * BYE IMAP4rev1 server terminating connection

>> a006 OK LOGOUT completed

Page 8: In f r a s t r u c t u r e s N e t w o r k in gX - M S M a il- P r io r it y : N o r m a l X - M a ile r : M ic r o s o f t O u t lo o k E x p r e s s 6 .0 0 .3 7 9 0 .3 9 5 9 X -

Author: Prof Bill Buchanan

Ne

t F

ore

ns

ics

POP-3

Page 9: In f r a s t r u c t u r e s N e t w o r k in gX - M S M a il- P r io r it y : N o r m a l X - M a ile r : M ic r o s o f t O u t lo o k E x p r e s s 6 .0 0 .3 7 9 0 .3 9 5 9 X -

PO

P-3

Ne

t F

ore

nsic

s

Author: Prof Bill Buchanan

POP-3

+OK POP server ready H mimap15 0LfD5x-1VsVU4327M-00pHSn

AUTH

-ERR 1 argument required

CAPA

+OK Capability list follows

TOP

USER

UIDL

STLS

SASL PLAIN

IMPLEMENTATION trinity

.

AUTH PLAIN

+

AGRpZ2l0YWxpbnZlc3RpZ2F0b3JAbmV0d29ya3NpbXMuY29tAG5hcGllcjEy

Mw==

+OK mailbox "[email protected]" has 3 messages (19191

octets) H mimap15

STAT

+OK 3 19191

LIST

+OK

1 5565

2 8412

3 5214

.

UIDL

+OK

1 0M8Oog-1VyW6I2B74-00vNGA

2 0LalaO-1VwtZq3DAW-00kuzg

3 0MLPgA-1VC2Ru34ja-000jOl

.

RETR 1

+OK

Return-Path: <[email protected]>

Delivery-Date: Thu, 22 Aug 2013 21:14:44 +0200

Received: from mbulk.1and1.com (mbulk.1and1.com [212.227.126.222])

.by mx.kundenserver.de (node=mxeu0) with ESMTP (Nemesis)

Email server

- IMAP 4 (RFC 3501). TCP: 143/993

- POP-3. TCP 110/993

- Exchange.

USER name

PASS password

RETR mailbox

REDEL mailbox

RVEC

RCVD

QUIT

NOOP

RSET

Page 10: In f r a s t r u c t u r e s N e t w o r k in gX - M S M a il- P r io r it y : N o r m a l X - M a ile r : M ic r o s o f t O u t lo o k E x p r e s s 6 .0 0 .3 7 9 0 .3 9 5 9 X -

DigitalInvestigator

Networking

Infrastructures

SMTP, POP-3 and IMAP


Burlington - maine.gov...W y m a n B r o o k M a d a g a s c a l S t r e a m M e r r i l l o B r o o k R o c k y B r o o k F o g g B r o o k F o g g B r o k E s k u t a s s i s S t

Burlington - maine.gov...W y m a n B r o o k M a d a g a s c a l S t r e a m M e r r i l l o B r o o k R o c k y B r o o k F o g g B r o o k F o g g B r o k E s k u t a s s i s S t

Introducción documento seccionado barrios · Dirección General de Estadística n s l a s i i o o o o o n o n l s r a l r o s n a r r o s u a o o s n e o Pedroñeras o r a a o s

Introducción documento seccionado barrios · Dirección General de Estadística n s l a s i i o o o o o n o n l s r a l r o s n a r r o s u a o o s n e o Pedroñeras o r a a o s

B VS 1 ]ZR E O g - Tufport · T] ` O R S R WQ O bS R b`O \ a^ ] `b d S V WQ ZS ; O R S T`] [ W\ R c ab `WO Z U `O R S aO \ R e WQ V Q ] `S Q ] [ ^ ] aWbS bV S R c `O P ZS 9 = = :

B VS 1 ]ZR E O g - Tufport · T] ` O R S R WQ O bS R b`O \ a^ ] `b d S V WQ ZS ; O R S T`] [ W\ R c ab `WO Z U `O R S aO \ R e WQ V Q ] `S Q ] [ ^ ] aWbS bV S R c `O P ZS 9 = = :

A G R O P E C U A R I O S S E G U R O S

A G R O P E C U A R I O S S E G U R O S

P R O C E S S O S E L E T I V O C U R S O S S U P E R I O ...

P R O C E S S O S E L E T I V O C U R S O S S U P E R I O ...

FIRST FLOOR PLAN - New Homes Division · 2018-05-02 · first floor plan n o r c r o s s a s t o r i a l o t 1 2. second floor plan n o r c r o s s a s t o r i a l o t 1 2. r lowry

FIRST FLOOR PLAN - New Homes Division · 2018-05-02 · first floor plan n o r c r o s s a s t o r i a l o t 1 2. second floor plan n o r c r o s s a s t o r i a l o t 1 2. r lowry

P R A I S E T H E L O R D F O R I T I S G O O D T O S I N G P R A I S E S T O O U R G O D.

P R A I S E T H E L O R D F O R I T I S G O O D T O S I N G P R A I S E S T O O U R G O D.

O S S AV GE - dot.state.mn.us€¦ · Ford Pond S O O S O O S O O S O O UP U P U P T C W R U P UP U P UP TC W R T C W R P G R S O O Memorial Park Cardinal Ridge Park Murphy-Hanrehan

O S S AV GE - dot.state.mn.us€¦ · Ford Pond S O O S O O S O O S O O UP U P U P T C W R U P UP U P UP TC W R T C W R P G R S O O Memorial Park Cardinal Ridge Park Murphy-Hanrehan

M O O R E S T O W N F R I E N D S S C H O O L R E T U R N ... · T A B L E O F C O N T E N T S M O O R E S T O W N F R I E N D S S C H O O L | R E T U R N T O S C H O O L 2 0 2 0

M O O R E S T O W N F R I E N D S S C H O O L R E T U R N ... · T A B L E O F C O N T E N T S M O O R E S T O W N F R I E N D S S C H O O L | R E T U R N T O S C H O O L 2 0 2 0

S O L V IN G S O M E G E N E R A L NONHOMOGENEOU S R E C … · s o l v in g s o m e g e n e r a l n o n h o m o g e n e o u s r e c u r r e n c e relation s o f o r d e r r follow

S O L V IN G S O M E G E N E R A L NONHOMOGENEOU S R E C … · s o l v in g s o m e g e n e r a l n o n h o m o g e n e o u s r e c u r r e n c e relation s o f o r d e r r follow

C r i m s o n R i d g e S p o n s o r s h i p O p p o r tu ...

C r i m s o n R i d g e S p o n s o r s h i p O p p o r tu ...

E c o - s y s t e m s S T O R Y T H R E E R e s t o r i n g

E c o - s y s t e m s S T O R Y T H R E E R e s t o r i n g

T W O s c h o l a r s h i p s f o r F l o r i d a s ch o o ...€¦ · T W O s c h o l a r s h i p s f o r F l o r i d a s c h o o l h i l d r e n StepUp4Students @StepUp4Students

T W O s c h o l a r s h i p s f o r F l o r i d a s ch o o ...€¦ · T W O s c h o l a r s h i p s f o r F l o r i d a s c h o o l h i l d r e n StepUp4Students @StepUp4Students

O u r p r o m i s e to y o u Y o u r p r o m i s e to u s

O u r p r o m i s e to y o u Y o u r p r o m i s e to u s

l r R S S | T O O O R ^ S ^ T T C h X J [ g æ t æ µ v Ì · l r R S S | T O O O R ^ S ^ T T C h X J [ g k r o ` q s r ( s q c) ... ± Ì x Í k r o ` q s r i s q c j T C h X J

l r R S S | T O O O R ^ S ^ T T C h X J [ g æ t æ µ v Ì · l r R S S | T O O O R ^ S ^ T T C h X J [ g k r o ` q s r ( s q c) ... ± Ì x Í k r o ` q s r i s q c j T C h X J

PEBBLE BEACH · c o n g r e s s r d f o r e s t l o d g e r d c o n g r e s s r d s p y g l a s s h i l l r d t e v e n s o n d r s t e v e n s o n 1 d r f o r e s t golf course l

PEBBLE BEACH · c o n g r e s s r d f o r e s t l o d g e r d c o n g r e s s r d s p y g l a s s h i l l r d t e v e n s o n d r s t e v e n s o n 1 d r f o r e s t golf course l

o u r r e s o r t

o u r r e s o r t

L R N S £¤ O N SR a d a Q W R o ad 1 W Ro ad 10 S R d a o a d M S d I O k S t S R o a H R o d O R o d G P r k S t S o a d D S F N R o a d G M N i p p S t N R o d M E Ro d 1 W R o

L R N S £¤ O N SR a d a Q W R o ad 1 W Ro ad 10 S R d a o a d M S d I O k S t S R o a H R o d O R o d G P r k S t S o a d D S F N R o a d G M N i p p S t N R o d M E Ro d 1 W R o

M O T H E R 'S S T O R I E S and S T O R I E S O F A B D U ...

M O T H E R 'S S T O R I E S and S T O R I E S O F A B D U ...

G I R L S L O V E H O R S E S

G I R L S L O V E H O R S E S