Slide 1Email VideosReading Email HeadersSlide 4Slide 5Slide 6Slide 7Slide 8Slide 9Another Example – Partial HeaderSlide 11Mobile Phone ForensicsSlide 13Slide 14Slide 15Smart Phone VideosProblems with Mobile ForensicsRemote Phone WipesSecuring Mobile PhonesSlide 20Slide 21SIMConComparing 3G to 4GDigital NetworksSmart PhonesSlide 26Slide 27Slide 28Slide 29Slide 30Slide 31Jailbreaking & UnlockingRecovering Deleted FilesWeb Sites - EmailWeb Sites – Mobile PhonesGrover Kearns, PhD, CPA, CFEClass 111Email Videos2How email workshttp://www.youtube.com/watch?v=YBzLPmx3xTUEmail Spoofinghttp://lybio.net/household-hacker-hacking-email-spoofing-101/science-technology/SMTP Spoofinghttp://www.youtube.com/watch?v=Up6XcxEilp4&feature=relatedTracing an emailhttp://www.youtube.com/watch?v=hSvswzSy3oAReading Email Headers From <<my-work-address>> Sat Aug 17 16:00:24 2002Return-Path: <<my-work-address>>Received: from exanpcn4.arinc.com ([144.243.4.70]) by mta009.verizon.net?????(InterMail vM.5.01.05.09 201-253-122-126-109-20020611) with ESMTP?????id <[email protected]>?????for <<my-home-address>>; Sat, 17 Aug 2002 15:00:09 -0500Received: from exanpcn2.arinc.com (unverified) by exanpcn4.arinc.com?????(Content Technologies SMTPRS 4.1.5) with ESMTP id?<[email protected]> for <<my-home-address>>;????Sat, 17 Aug 2002 16:02:15 -0400Received: by exanpcn2.arinc.com with Internet Mail Service (5.5.2653.19)?????\tid <QRZ549XW>; Sat, 17 Aug 2002 16:00:27 -0400Message-ID: <[email protected]>From: "Conner, Richard C. \\(RCONNER\\)" <<my-work-address>>To: "my-home-address" <<my-home-address>>Subject: HelloDate: Sat, 17 Aug 2002 16:00:26 -0400MIME-Version: 1.0X-Mailer: Internet Mail Service (5.5.2653.19)Content-Type: text/plain3From <<my-work-address>> Sat Aug 17 16:00:24 2002Return-Path: <<my-work-address>>Received: from exanpcn4.arinc.com ([144.243.4.70]) by mta009.verizon.net?????(InterMail vM.5.01.05.09 201-253-122-126-109-20020611) with ESMTP?????id <[email protected]>?????for <<my-home-address>>; Sat, 17 Aug 2002 15:00:09 -0500Received: from exanpcn2.arinc.com (unverified) by exanpcn4.arinc.com?????(Content Technologies SMTPRS 4.1.5) with ESMTP id?<[email protected]> for <<my-home-address>>;????Sat, 17 Aug 2002 16:02:15 -0400Received: by exanpcn2.arinc.com with Internet Mail Service (5.5.2653.19)?????\tid <QRZ549XW>; Sat, 17 Aug 2002 16:00:27 -0400Message-ID: <[email protected]>From: "Conner, Richard C. \\(RCONNER\\)" <<my-work-address>>To: "my-home-address" <<my-home-address>>Subject: HelloDate: Sat, 17 Aug 2002 16:00:26 -0400MIME-Version: 1.0X-Mailer: Internet Mail Service (5.5.2653.19)Content-Type: text/plainNot required by SMTPFrom <<my-work-address>> Sat Aug 17 16:00:24 2002Return-Path: <<my-work-address>>Received: from exanpcn4.arinc.com ([144.243.4.70]) by mta009.verizon.net?????(InterMail vM.5.01.05.09 201-253-122-126-109-20020611) with ESMTP?????id <[email protected]>?????for <<my-home-address>>; Sat, 17 Aug 2002 15:00:09 -0500Received: from exanpcn2.arinc.com (unverified) by exanpcn4.arinc.com?????(Content Technologies SMTPRS 4.1.5) with ESMTP id?<[email protected]> for <<my-home-address>>;????Sat, 17 Aug 2002 16:02:15 -0400Received: by exanpcn2.arinc.com with Internet Mail Service (5.5.2653.19)?????\tid <QRZ549XW>; Sat, 17 Aug 2002 16:00:27 -0400Message-ID: <[email protected]>From: "Conner, Richard C. \\(RCONNER\\)" <<my-work-address>>To: "my-home-address" <<my-home-address>>Subject: HelloDate: Sat, 17 Aug 2002 16:00:26 -0400MIME-Version: 1.0X-Mailer: Internet Mail Service (5.5.2653.19)Content-Type: text/plainunique message IDFrom <<my-work-address>> Sat Aug 17 16:00:24 2002Return-Path: <<my-work-address>>Received: from exanpcn4.arinc.com ([144.243.4.70]) by mta009.verizon.net?????(InterMail vM.5.01.05.09 201-253-122-126-109-20020611) with ESMTP?????id <[email protected]>?????for <<my-home-address>>; Sat, 17 Aug 2002 15:00:09 -0500Received: from exanpcn2.arinc.com (unverified) by exanpcn4.arinc.com?????(Content Technologies SMTPRS 4.1.5) with ESMTP id?<[email protected]> for <<my-home-address>>;????Sat, 17 Aug 2002 16:02:15 -0400Received: by exanpcn2.arinc.com with Internet Mail Service (5.5.2653.19)?????\tid <QRZ549XW>; Sat, 17 Aug 2002 16:00:27 -0400Message-ID: <[email protected]>From: "Conner, Richard C. \\(RCONNER\\)" <<my-work-address>>To: "my-home-address" <<my-home-address>>Subject: HelloDate: Sat, 17 Aug 2002 16:00:26 -0400MIME-Version: 1.0X-Mailer: Internet Mail Service (5.5.2653.19)Content-Type: text/plain7 From <<my-work-address>> Sat Aug 17 16:00:24 2002Return-Path: <<my-work-address>>Received: from exanpcn4.arinc.com ([144.243.4.70]) by mta009.verizon.net?????(InterMail vM.5.01.05.09 201-253-122-126-109-20020611) with ESMTP?????id <[email protected]>?????for <<my-home-address>>; Sat, 17 Aug 2002 15:00:09 -0500Received: from exanpcn2.arinc.com (unverified) by exanpcn4.arinc.com?????(Content Technologies SMTPRS 4.1.5) with ESMTP id?<[email protected]> for <<my-home-address>>;????Sat, 17 Aug 2002 16:02:15 -0400Received: by exanpcn2.arinc.com with Internet Mail Service (5.5.2653.19)?????\tid <QRZ549XW>; Sat, 17 Aug 2002 16:00:27 -0400Message-ID: <[email protected]>From: "Conner, Richard C. \\(RCONNER\\)" <<my-work-address>>To: "my-home-address" <<my-home-address>>Subject: HelloDate: Sat, 17 Aug 2002 16:00:26 -0400MIME-Version: 1.0X-Mailer: Internet Mail Service (5.5.2653.19)Content-Type: text/plain8 From <<my-work-address>> Sat Aug 17 16:00:24 2002Return-Path: <<my-work-address>>Received: from exanpcn4.arinc.com ([144.243.4.70]) by mta009.verizon.net (InterMail vM.5.01.05.09 201-253-122-126-109-20020611) with ESMTP?id <20020817200009.CWZT20372.mta009. [email protected]>?for <<my-home-address>>; Sat, 17 Aug 2002 15:00:09 -0500Received: from exanpcn2.arinc.com (unverified) by exanpcn4.arinc.com?????(Content Technologies SMTPRS 4.1.5) with ESMTP