CLIENT- AND WEB-BASED E-MAIL

Client- and web-based e-mail readers share much in common. Both can have e-mail headers, proofs of receipt, attachments, and more. Both generally follow the same rules as outlined in the RFCs (Requests For Comments). However, some differences are worth exploring, including the viewing methods , location of the evidence, and how easy it is to access and recover the evidence.

Client-based e-mail includes programs such as Outlook and Outlook Express. Client e-mail is typically stored on the hard drive in a known e-mail archive. Web-based e-mail such as Yahoo! and Hotmail challenges investigators to find e-mail on the computer, reconstruct activity, and identify users in ways that are different from client-based e-mail. Depending on the web mail service, where the e-mail is stored, how it is stored, and other factors, you may find nothing, the entire e-mail, or an e-mail remnant. E-mail remnants are stored on a drive found on the media during analysis. Examples include previously deleted e-mails, web-based e-mail, and partially overwritten e- mails .

Web-based e-mail allows users to choose their own e-mail addresses. This makes it more difficult to identify users than with typical corporate e-mail systems. An address that doesn't definitely identify a user , such as [e-mail], makes it difficult to identify a suspect. [e-mail] pretty much nails a user's identity.