E-mail Forensics in a Corporate Exchange Environment (Part 2)

If you would like to read the other parts in this article series please go to:

• E-mail Forensics in a Corporate Exchange Environment (Part 1)
• E-mail Forensics in a Corporate Exchange Environment (Part 3)
• E-mail Forensics in a Corporate Exchange Environment (Part 4)
• E-mail Forensics in a Corporate Exchange Environment (Part 5)

Message Tracking Logs

Message Tracking is an Exchange feature that records log files of e-mail traffic as messages travel between mailboxes within the organization. These logs help track message flow as they provide information about the path the message has taken as it makes its way through Exchange as well as information regarding the sender, recipient, message subject, and date and time. They can also be used to troubleshoot issues related to mail flow, produce reports, or to even analyze e-mail traffic patterns.

While with Exchange 2000 and 2003 message tracking had to be manually enabled, since the 2007 version it is enabled by default to record the last 30 days of e-mail activity. This is a feature of the Transport Service and since every single message has to go through this service even if the sender and recipient are on the same mailbox server, it becomes easy for Exchange to record information regarding e-mail flow.

First we need to check the current status of message tracking on all transport servers so we can verify if information regarding the e-mail(s) being investigated was logged. By using the Exchange Management Shell, we run the following cmdlet:

Figure 2.1: Checking Message Tracking Log Settings

As we can see, MessageTrackingLogEnabled is set to True and MessageTrackingLogMaxAge is set to 30 days, meaning that information regarding every e-mail flowing through the Exchange organization is being logged and kept for 30 days.

Figure 2.2: Original Innocent E-mail

If message tracking is enabled and keeping logs that cover the time period we are interested in for the investigation, then we can start looking for our message using the Get-MessageTrackingLog cmdlet:

Figure 2.3: Gathering Data using Message Tracking Logs

As we can see from the screenshot above, Offender sent an e-mail at “27/04/2013 15:36:11” to the user Victim with the subject Drinks. This e-mail is first identified by the EventId of RECEIVE, meaning Exchange received the e-mail from the user. The Mail Submission service then successfully notified a Hub Transport server that the message is awaiting submission in the mailbox store (EventId SUBMIT), and finally the message was delivered to the recipients’ mailbox (EventId DELIVER).

The problem here is that these logs do not contain the body of the e-mail itself. As such, at this stage we can only prove that an e-mail was sent and delivered by the two parties involved.

eDiscovery

eDiscovery helps organizations perform discovery searches for relevant content within users’ mailboxes. This may be a requirement by an organizational policy, compliance or even a lawsuit for example.

To perform an eDiscovery search in Exchange, administrators use a feature called Multi Mailbox Search in Exchange 2010 or In-Place eDiscovery in Exchange 2013. These features are able to search one or more mailboxes for items (e-mails, calendar appointments, tasks, etc.) that match keywords specified. It is also possible to narrow the search to a specific period of time, allowing the search to perform much quicker and to reduce the number of false-positive matches.

In order for eDiscovery to be useful for an investigation, one of the follow requisites needs to be meet:

• Single Item Recovery is enabled for the mailboxes being investigated and the retention period (14 days by default) has not yet passed;
• Mailboxes being investigated were placed on Litigation Hold or in-Place Hold before the e-mail was sent/received and are still on Litigation Hold at the time of the investigation.

If one of these conditions is met, then an administrator can recover any deleted e-mail from users’ mailboxes (discounting the fact that they can possibly be on backup). Possibly more important in some scenarios, is using these features on the victim’s mailbox. Because a copy of every item modified is also kept when these are manually edited, this allows the investigator to determine if the victim tampered with the received e-mail in order to frame someone or gain advantage of a situation.

Litigation Hold, the hold feature introduced in Exchange 2010 to preserve data for eDiscovery, is still available in Exchange 2013 and on the new version of Exchange Online (based on Exchange 2013). Whereas In-Place Hold provides granular hold capability based on query parameters, hold period and the ability to place a mailbox on multiple holds, litigation hold only allows changing to place all items on hold indefinitely or until hold is removed.

•   Exchange 2010 Litigation Hold;
•   Exchange 2013 In-Place Hold and In-Place eDiscovery;
•   Litigation Hold vs. Single Item Recovery vs. Retention Hold;
•   Managing Multi-Mailbox Search in Exchange Server 2010.

If hold or single item recovery is enabled on mailboxes being investigated, they can prove invaluable for the investigation as they can retain any deleted or tampered e-mails until the investigation is complete or the administrator decides otherwise. Assuming this is the case, let us see how to take advantage of these features.

Assuming Hold was enabled when the e-mail was received and that it is still enabled, we can perform an eDiscovery search on the victim’s mailbox to gather all items relevant to the investigation.

When we open the results of our search of the Victim’s mailbox, we see the search found two items: the altered e-mail in the user’s Inbox folder and a saved copy in the Versions special folder (because Hold was enabled when the user modified the e-mail). We can see that the From, Subject and Received fields are identical. However, the Size and, more importantly, the Body are not:

Figure 2.4: Tampered E-mail

Figure 2.5: Original Innocent E-mail

Hold and Single Item Recovery are two features crucial for any investigation. They allow not only the recovery of any deleted item, but also to easily check if items have been tampered with. If we were looking for a deleted e-mail, the procedure would have been identical but the original e-mail(s) would be located in the Purges special folder instead.

Conclusion

In this second part of our article, we started to look at extracting data using Exchange features, namely using Message Tracking Logs and eDiscovery. In the next article, we will use Mailbox and Administrator Auditing.

If you would like to read the other parts in this article series please go to:

• E-mail Forensics in a Corporate Exchange Environment (Part 1)
• E-mail Forensics in a Corporate Exchange Environment (Part 3)
• E-mail Forensics in a Corporate Exchange Environment (Part 4)
• E-mail Forensics in a Corporate Exchange Environment (Part 5)