Sudhir Aggarwal
Florida State University
USA

Jasbinder Bali
Florida State University
USA

Zhenhai Duan
Florida State University
USA

Leo Kermes
Florida State University
USA

Wayne Liu
Florida State University
USA

This paper describes the design and development of a software system to support law enforcement in investigating and prosecuting email based crimes. It focuses on phishing scams which use emails to trick users into revealing personal data. The system described in this paper, called the Undercover Multipurpose Anti-Spoofing Kit (UnMask), will enable investigators to reduce the time and effort needed for digital forensic investigations of email-based crimes. A novel aspect of UnMask is its use of a database to not only store information related to the email and its constituent parts (such as IP addresses, links, domain names), but also to organize a workflow to automatically launch UNIX tools to collect additional information from the Internet. The retrieved information is in turn added to the database. Reports are then automatically generated for the forensic investigator, including correlations across multiple email data stored in the database. UnMask is a working system. To the best of our knowledge, UnMask is the first comprehensive system that can automatically analyze emails and generate forensic reports that can be used for subsequent investigation and prosecution.

Keywords: Digital forensics, phishing scams, email, electronic crime, investigation, evidence, software systems

Read Paper (in PDF)