Manuel Escamilla wrote:

>Hello,
>I am working for a lawyers firm and we have a case
>where it is necessary to prove that an email was sent
>from an specific computer or email account. How can I
>prove that? it is possible to track emails or I am
>wasting my time?
>
>Thank you in advance.
>
Your question is not very clear. Do you want to trace the email to a specific machine or a specific email address or both? Do you know which machine it was sent from? Depending on the email system, there may be a copy of it on the server. If that is not an option, a forensic examination of the computer using a product like Encase or ILook would probably turn up the actual email or a fragment of it. Of course there are many variables; did the person do a regular defrag of the drive?, has it been formatted or low level formatted lately?, how long since the email was sent?, etc. Even if all of those questions are answered with a yes, it is still possible to find the email on the computer. A good forensics investigator can do wonders. How deep are your pockets?

If it is a criminal offense, then local law enforcement or the FBI may be willing to help, depending on the circumstances.
--
Freeman Mendell, CISA, Certified Computer Crimes Investigator
EDP Audit Manager
Galveston County Auditor's Office
(409) 770-5325
(281) 316-8300 x5325

               The NOSPIN Group Promotions is now offering
              Mandrake Linux or Red Hat Linux CD sets along
             with the OpenOffice CD...  at a great price!!!
             http://freepctech.com/goodies/promotions.shtml