1. Email Tracing Examples
Computer Forensics
Tracing Examples

2. Microsoft Mail Internet Headers Version 2. 0 Received: from SEARCH
Microsoft Mail Internet Headers Version 2.0 Received: from SEARCH.ORG ([ ]) by sgisrv1.search.org with Microsoft SMTPSVC( ); Wed, 23 Oct :53:19 –0700 Received: from hotmail.com ([ ]) by SEARCH.ORG with ESMTP (IOA-IPAD 2.54) id ; Wed, 23 Oct :59:54 –0800 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Wed, 23 Oct :53:19 –0700 X-Originating-IP: [ ] From: "TC" To: Subject: Kittens for sale Date: Wed, 23 Oct :48:16 –0700 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000A_01C27A81.B1743CB0“ X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express X-MimeOLE: Produced By Microsoft MimeOLE V Message-ID: X-OriginalArrivalTime: 23 Oct :53: (UTC) FILETIME=[1216D8D0:01C27ABD] Return-Path:

3. From tschwarz@cse.ucsc.edu Fri Jan 16 15:51:11 2004
Return-Path:
Received: from sundance.cse.ucsc.edu (sundance.cse.ucsc.edu [ ])
by server4.engr.scu.edu ( / ) with SMTP id i0GNpA8K007608
for Fri, 16 Jan :51:
Received: (from by sundance.cse.ucsc.edu (8.6.10/8.6.12) id
PAA18463 for Fri, 16 Jan :51:
Date: Fri, 16 Jan :51:
From: Thomas Schwarz
Message-Id:
To:
Subject:
X-Spam-Checker-Version: SpamAssassin 2.60-rc3 ( exp) on
server4.engr.scu.edu
X-Spam-Level:
X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=ham version=2.60-r c3
This is a test.

4. Return-Path: <rhn-bounce+2443612-3000675@rhn.redhat.com>
Received: from rhn-mail.rdu.redhat.com (mail.rhn.redhat.com) [ ] by mail.zionsvillepd.com (8.12.8/8.12.5) with ESMTP id h5J5iCjI022534
for Thu, 19 Jun :44:
Received: from admin.rdu-colo.redhat.com (nat-pix.rdu-colo.redhat.com [ ]
by rhn_mail.rdu-colo.redhat.com (8.11.6/8.11.6) with ESMTP id h5J5amx01895
for Thu, 19 Jun :36:
Received: from admin.rhu-colo.redhat.com (localhost.localdomain [ ])
by admin.rdu-colo.redhat.com (8.11.6/8.11.6) with ESMTP id h5J5WW920293
for Thu, 19 Jun :32:
Date: Thu, 19 Jun :32:
Message-Id:
Subject: RHN Errata Alert: Updated WindowMaker packages fix vulnerability in theme-loading
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-RHN-Info: Autogenerated mail for ZPD
X-RHN-
Precedence: first-class
Errors-To:
From: Red Hat Network Alert
To: ZPD
X-RHN-Login: ZPD

5. From mixmaster@futureworlds.it Fri Jan 16 15:45:07 2004
Return-Path:
Received: from (ip customer.panservice.it [
4.81])
by server4.engr.scu.edu ( / ) with ESMTP id i0GNj58K004457
for Fri, 16 Jan :45:
Received: by (Postfix, from userid 1011)
id 8CE991F0F5A; Sat, 17 Jan :45: (CET)
From: futureworlds
To:
Subject: Test
Message-ID:
Date: Sat, 17 Jan :45: (CET)
X-Spam-Checker-Version: SpamAssassin 2.60-rc3 ( exp) on
server4.engr.scu.edu
X-Spam-Level:
X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=ham version=2.60-rc3