A webmail reconstructing method from windows XP memory dumps

Abstract

Retrieving the content of webmail from physical memory is one key issue for investigators because it may provide with useful information. This paper proposes a webmail evidence reconstructing method from memory dumps on Windows XP platform. The proposed method uses mail header format defined in RFC2822 and HTML frame based on specific webmail server to locate header and body respectively. Then webmail is reconstructed based on matching degree between FROM, TO(CC/BCC), DATE and SUBJECT fields of header and corresponding content extracted from body. The experiment results show that this method could reconstruct the webmail from memory dumps. © 2013 Springer Science+Business Media Dordrecht(Outside the USA).