Digital Forensics Tool: mailMeta

Reading Time: 2 Minutes

mailMeta

mailMeta by gr33nm0nk2802 is a forensics tool to make analysis of email headers easy to aid in the quick discovery of the attacker.

• What is mailMeta?

mailMeta is a python based forensic tool which reads through the email headers from the email file and extracts crucial information to identify if the email is legitimate.

• What are the advantages of using mailMeta?

Have you ever heard of email hacking or sophisticated email crimes where a spoofed email is sent to the victim and the victim trusts this email based on the email address which is in fact fake. These email contains malicious links which can be used to extract some information or install some malware or backdoors on your device. So, in order to avoid you from this mailMeta comes to your rescue.

Here I have added instructions on how to download the email from the file and then pass it to the mailMeta executable. It then parses the headers and informs you if the mail is genuine or not. Whenever you are suspicious about an email be sure to check it once here. It can save you in most of the scenarios. If anyone has some ideas/updates feel free to open an issue or create a pull request.

What are the information revealed by the mailMeta? It parses the following headers:

• Message-ID
• SPF-Record
• DKIM-Record
• DMARC-Record
• Spoofed Email detection based on the above headers
• IP-Address of the sender
• Service Provider used for sending the email
• Content-Type
• Data and Time
• Subject

Why is it important to check such parameters?

• ONGC Email Phishing There are many more such cases which you can find online related to email crimes.

You have two methods to use metaMail. Either you can download the github repo and run the meta.py file from the command line. Make sure you have all requirements installed in this case like python3. You may also run the standalone binaries. This is for those who have very little technical knowledge.

1. Clone the repository

git clone https://github.com/gr33nm0nk2802/mailMeta

2. Running from the meta.py file

cd mailMeta

python3 meta.py

Additionally you can directly download the executable from the Releases and use them.

Usage

Either you are on windows or Linux first download the original metadata of the email using the show original / view raw / download original option.

Then we pass the eml file to the executable.

This is a demo of how to download the mail. You should find something similar.

Linux

1. Use meta.py from the cloned repo. (Python is required)

python3 meta.py -f message.eml

or

2. Downloading the meta executable for Linux and giving it executable permissions. Then supplying the eml file to the pre-compiled binary. (No dependencies)

wget https://github.com/gr33nm0nk2802/mailMeta/releases/download/1.0.0/meta

chmod +x meta

meta -f message.eml

Windows

1. Executing the precompiled binaries downloaded from the releases page. (No dependencies needed)

meta.exe -f .\message.eml

or

2. Running from the repository clonned (Python Required)

python3 meta.py -f message.eml

Demo

This is a sample demonstration explaining all the procedures. First it has the steps for running on Linux then it has the steps needed for running on windows just in case you are struck.

Clone the repo from here: GitHub Link