Welcome to this digital forensics scenario. You will analyze email server logs to trace the origin and routing of suspicious communications, focusing on SMTP artifact identification.
During an email-forensics investigation at a corporate headquarters in Chicago, several executives reported receiving sophisticated phishing emails designed to look like internal legal subpoenas. A forensic analyst has acquired a forensically sound image of the corporate mail server's storage volume and has begun carving out log files.
To determine the origin of the attack and build an accurate timeline of the intrusion attempts, the investigator zeroes in on the raw SMTP transit logs generated during the timeframe of the incident.
During an email-forensics investigation in Chicago, an analyst is examining the SMTP logs of a mail server to trace the path of a suspicious email. Which of the following information can be found in the SMTP logs?
The extracted maillog artifact clearly documents an inbound SMTP connection. It explicitly shows the source IP address (198.51.100.45), the date and time of the transaction (Apr 10 14:22:05), the sender's claimed address (from=<legal@chicago-corp-secure.com>), and the target recipient (to=<ceo@chicago-corp.com>).
This falls under the Examination and Analysis phase. The investigator is analyzing server-side application logs to trace digital movement, establish timelines, and extract Indicators of Compromise (IoCs).
Option A is correct. SMTP is the protocol used to transport email across the internet. Its logs are transactional and focus entirely on metadata regarding the delivery process. Consequently, SMTP logs will always record connection timestamps, connecting IP addresses, and the SMTP envelope data (MAIL FROM and RCPT TO addresses).
B is incorrect: While SMTP transmits the content, standard SMTP server logs do not store the email body or attachments due to privacy and storage constraints. To find content, an investigator must examine the recipient's mailbox (e.g., EDB, PST files) or a packet capture (PCAP) of the active session.
C is incorrect: Authentication credentials (passwords) are not logged in clear text within transit logs. Security best practices and standard logging configurations prevent the recording of passwords.
D is incorrect: Browsing history is an endpoint artifact (found in browser caches, index.dat, or WebCacheV01.dat). A mail transit server has absolutely no access to the local browsing activity of a connecting client.
In a real investigation, a forensic analyst uses these SMTP logs to map the attack infrastructure. The identified source IP (198.51.100.45) will be checked against Threat Intelligence platforms, and the firewall will be updated to block future connections. The message-id is then used to track the malicious message into the internal Exchange/O365 environment to purge it from user inboxes.
Explore more CHFI simulations and master digital forensics investigation.
Practice More Scenarios