Email Classification for Forensic Analysis by Information Gain Technique

2.1.1. Email structure

In 1982, a standard way for email provided by the Internet was defined. It is based on certain conventions adopted by Ray Tomlinson (Hazel, 2001), but they are updated to show the modern state of the Internet. The SMTP (Simple Mail Transfer Protocol) and POP3 (Post Office Protocol 3) are the underlying technologies behind the transfer of email from a web host to another. In the early days of the Internet, electronic mail systems use special protocols to transfer email from a proprietary system to another. Hence, an email is composed of two parts (McDonald, 2009): the first is the header and the second is the message body.

2.1.2. MIME Standard

MIME (Multipurpose Internet Mail Extensions) is a standard that was proposed by Bell Laboratories in 1991 to extend the limited possibilities of email and in particular to allow the insertion of documents (images, sounds, text, etc.) in email. It was originally defined by RFC 1341 and 1342 from June 1992 (Smith, 2006). MIME messaging has the following features:

• •

  Ability to have multiple objects (attachments) in a single message;

• •

  An unlimited message length;

• •

  The use of character sets (alphabets) other than ASCII;

• •

  The use of rich text (formatting of the messages, fonts, colors, etc.

• •

  The binary attachments (executable, images, audio or video files, etc.), possibly with several parts.