±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 6 Overall: 36583
New Yesterday: 6 Visitors: 169

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Email Question

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


Email Question

Post Posted: Nov 11, 08 00:59

Hello All,

While working on a case, I came across email that has some unusual email addresses. I know the email addresses of the parties involved but when viewing the email header, it looks like this:

Return-Path: <[email protected]>
X-Original-To: L469l5flB3 @ aqrOIl.9u
Delivered-To: L469l5flB3 @ aqrOIl.9u
Received: from bureau14.qwer.mysite.ca (bureau14.qwer.mysite.ca [])
by fep2.cogeco.net (Postfix) with ESMTP id 0C73721AA
for <[email protected]>; Sun, 22 Aug 2004 15:27:41 -0400 (EDT)

NOTE: I have changed the line "Received: from bureau14.qwer.mysite.ca (bureau14.qwer.mysite.ca [])" to protect the innocent.

Anyone have any ideas as to how these addresses were changed and how are the parties able to communicate using such addresses?


Senior Member

Re: Email Question

Post Posted: Nov 11, 08 10:41

Is that the SHORT header or the LONG header?


Re: Email Question

Post Posted: Nov 11, 08 18:00

What I listed was from what you called the Long Header but the same appears in the Short Header.  

Page 1 of 1