Funkcionalnosć tutoho sydła so přez wothladowanske dźěła wobmjezuje, kotrež maja waše dožiwjenje polěpšić. Jeli nastawk waš problem njerozrisuje a chceće prašenje stajić, wobroćće so na naše zhromodźenstwo pomocy, kotrež na to čaka, wam na @FirefoxSupport na Twitter a /r/firefox na Reddit pomhać.

Avatar for Username

Pomoc přepytać

Hladajće so wobšudstwa pomocy. Njenamołwimy was ženje, telefonowe čisło zawołać, SMS pósłać abo wosobinske informacije přeradźić. Prošu zdźělće podhladnu aktiwitu z pomocu nastajenja „Znjewužiwanje zdźělić“.

Dalše informacije

Tuta nitka je so archiwowała. Prošu stajće nowe prašenje, jeli pomoc trjebaće.

Importing edited Mbox file from Gmail - Manipulation test

  • 1 wotmołwa
  • 1 ma tutón problem
  • 1 napohlad
  • Poslednja wotmołwa wot Matt

bwbeachbar
bwbeachbar
more options

I am testing the theory behind manipulated emails and what forensic evidence can be obtained.

I notice that when Google Takeout is used to export emails from a Gmail account and are subsequently edited (in this case, the body text), SPF alters from "PASS" to "NONE with IP 0.0.0.0" and DKIM completely disappears in the "Original Message" view, however the headers remain unchanged with the exception of the edits to the body text.

The unedited email indicates SPF as "Pass" and DKIM as "Pass" (first image). This changes in the second image once any alteration is applied to the original email.

Before importing the email via Thunderbird, I delete the original email in Gmail (including the trash) and then load the manipulated email to Thunderbird and subsequently to the Gmail inbox.

Is there an explanation for the change in SPF and disappearance of DKIM to the manipulated email?

I am testing the theory behind manipulated emails and what forensic evidence can be obtained. I notice that when Google Takeout is used to export emails from a Gmail account and are subsequently edited (in this case, the body text), SPF alters from "PASS" to "NONE with IP 0.0.0.0" and DKIM completely disappears in the "Original Message" view, however the headers remain unchanged with the exception of the edits to the body text. The unedited email indicates SPF as "Pass" and DKIM as "Pass" (first image). This changes in the second image once any alteration is applied to the original email. Before importing the email via Thunderbird, I delete the original email in Gmail (including the trash) and then load the manipulated email to Thunderbird and subsequently to the Gmail inbox. Is there an explanation for the change in SPF and disappearance of DKIM to the manipulated email?
Připowěsnjene fota wobrazowki

Wšě wotmołwy (1)

Matt
Matt
  • Moderator
  • Top 10 Contributor
more options

Details on the SPF standard can be found here. https://datatracker.ietf.org/doc/html/rfc7208 and DKIM here https://datatracker.ietf.org/doc/html/rfc6376

Both of these are server side technologies and well beyond the scope of this forum.