How to Trace an Email Like the FBI - Digital Forensics Tutorial

Disclaimer: I am not a lawyer or law enforcement officer and this video is for demonstration and entertainment purposes only.

Ever wondered how the police and special agents determine who committed a computer crime? In this video, I demonstrate how the FBI and other law enforcement agencies may track down cyber criminals through email forensics!

Resources:

Email Attacks
- Spamming
- Phishing
- Mail bombing
- Cyberstalking
- Child abduction

Steps for conducting email crime investigations
1. Seizing the computer and email accounts
2. Acquiring the email data
3. Examining email messages
4. Retrieving email headers
5. Analyzing email headers
6. Recovering deleted email messages

Thank you for watching!

[simulationoverload]

Just one update to your process based upon the date the email was sent from the source. The date you highlighted is not the date to be referenced as that is the source system's date & time and could be inaccurate. The date/time you want to use is the date and time from the last (bottom) mail server in the stack. Unless the sender has influence over the initial receiving mail server, but this would be easily observable by the difference in time from the next mail server in the stack (the next entry above the last mail server being reviewed). Using these date/timestamps along with geolocation data of the IP registration will indicate if the times are off, possibly indicating an effort to hide the source location.

This would also be the date/time you would actually need to submit in any subpoena if you are to obtain accurate records.

Other than that, a well-done education piece.

[ProducerGio]

Dude, you're awesome! This was detailed and well-spoken!

[emusunlimited]

Good video, I didn’t know about that tracer program at the end, that’s pretty cool. When I worked at an ISP about 5 years ago that kind of geolocation data was expensive, and usually locked behind a pay as you go API. I want to point out that Ashburn VA is a major data center hub. Like every FAANG company has a major presence there, plus tons of other data centers and ISPs, and even T1 carriers. Even the small ISP I worked for had a presence there. When you see an IP originating from Ashburn it’s almost certainly not really. It’s more likely that’s either a web client, or the originator is using some kind of VPN or VPS that runs in a data center there.

[Dr_Larken]

I just came across this channel, I feel like it has so much potential! I hope you continue to upload more Longer videos!

[PirateAlgeria]

please make more videos like this would be happy to learn

[Tom-sgiv]

Your trace route has nothing to do with the route the email took to your inbox.

[AshleyArsenicArt]

This was neat. I have no idea how I arrived here, but hey! Thanks for the information!!

[PirateAlgeria]

Thank you for this video, its really helpful, more than you think

[Ellsworth]

That was fantastic! The last software was new to me... Any advice on how to prevent all of this?

[chillphil]

16:41 lol “…if you’re a civilian, i do not recommend you go any further…” pencils down, class.
cool video though 👍

[FredYduciel]

Thanks a lot Sir 🙏 u just got a new subscriber today 😅

[inheaveneverythingsfine]

Make more videos especially about topics related to law enforcement and cyber crime

[JesusFireChannel]

Ethical J Please do a video of malware Analysis?

[sheldonthomas]

What if the person use a cheap burner phone with no SIM card and create a cloud email on a Starbucks WiFi?

[moneyman]

So if I hypothetically make my own subpoena on a vpn and send it to Verizon how do they check if im actually law enforcement or do they not… 😁

[BufferTheHutt]

pretty nice. I work as an IT-Foreniscs analyst for German law enforcement (subject area: CSAM). Nice to see how it's going on in another country😀

[FrankBevins-khmq]

I remember I had something like this happen and the FBI didn’t help. What are they good for?

[vak]

love these fucking tiny pop-up youtube osint channels... always the best stuff!

[jacklewis]

The most useless first 60 seconds of any video...wasted my time...not going to waste any more

[williamelewis]

This sounds like you sat through a for pay hacking web series or seminar by folks that know F-all about cybersecurity nor how those 3 letter agencies gather their information and intel. What you are describing is what a small police force would use or ask of a moderate sized police force not the FBI/NSA/CIA/DOD uses at all.