Most e-mail is sent using the Simple Mail Transfer Protocol (SMTP). In some investigations, SMTP servers, also called Mail Transport Agents (MTAs), provide an important source of evidence. We are not referring to an e-mail itself, but rather the logs generated by servers that handle e-mail. For example, if you detect that one of your users received a phishing e-mail, how can you determine if it was sent to anyone else? In enterprises that span the globe, local laws and policy may prevent you from searching everyone's e-mail boxes. In addition, you may have numerous servers with terabytes of data—the search could take days. SMTP servers that maintain logs—ideally in a central location—can help you quickly answer that question.
CAUTION: You may wonder why we don't go into e-mail storage and retrieval topics in this chapter—or in the book. Not only are enterprise e-mail systems complex, but there are many legal and policy issues associated with accessing someone's e-mail. It's best for a responder to consult with e-mail administrators and legal council, at a minimum, before attempting to access e-mail content as part of an investigation. There's likely an established procedure you need to follow.
Who sent or received an e-mail This is normally based on metadata details, such as the date and time, size, subject, sender, or recipient. We perform this search to answer questions such as the one we asked earlier—who received a phishing e-mail? Was it forwarded to anyone else?
All e-mail sent to or from a user This broadens the search related to a specific user. If evidence suggests an account was compromised, or sustained malicious activity occurred, it might be useful to see a complete summary of all e-mail sent to or from a user.
All e-mail sent to or from another SMTP server In the case of phishing campaigns, where attackers send many e-mails over a sustained period of time, you may be able to identify SMTP servers they are using. You can perform a search for those servers in the logs, in an attempt to uncover additional malicious activity.
For the common SMTP servers we mentioned earlier, we're going to discuss where logs are located and provide sample log entries. The logs for all three servers are stored in plain text by default, so you can use standard text utilities to view and process them.
Let's get started with looking at the Postfix server.
Syslog The default configuration file is /etc/syslog.conf.
Syslog-ng The default configuration file is /etc/syslog-ng/syslog-ng.conf.
Rsyslog The default configuration file is /etc/rsyslogd.conf, with additional configuration files in the directory /etc/rsyslog.d.
The filenames and paths for syslog configuration files may vary. You should consult with the system administrator if you have difficulty locating the configuration file.
In this case, the e-mail client connected from an IP address of 172.20.63.1, and submitted a 446-byte message. Postfix then discovered an appropriate destination e-mail server (in this case, xmail01.evil.example) and successfully submitted the message. Because syslog log files are normally in plain text, you can use any text-processing tool, such as grep, to search for items of interest.
In this case, an e-mail was received from billy@evil.example, from the host mail.evil.example, and was delivered to bob@example.com on the local server.
Microsoft Exchange records log data equivalent to Postfix and Sendmail. The logs are called Message Tracking logs, and they are enabled by default. If you find that message tracking logs are not present, you can check to see if they are enabled in the Exchange admin center, under Servers | Edit | Transport Logs.
In this example, an e-mail client at the IP address 192.168.200.154 connected to the server at IP address 192.168.200.155 and submitted a message from bob@example.com to the local account Administrator@test.org.