Seizing the computer and email accounts (Step 5): This is the initial step to secure potential evidence. It involves physically or remotely seizing the suspect’s computer and email accounts to prevent tampering.

Acquiring the email data (Step 1): After seizing the devices, investigators acquire the email data. This includes collecting email files, attachments, and metadata.

Retrieving email headers (Step 6): Email headers contain valuable information such as sender IP addresses, timestamps, and routing details. Retrieving headers helps trace the email’s origin.

Analyzing email headers (Step 2): Investigators analyze the headers to identify any anomalies, spoofing, or suspicious patterns.

Examining email messages (Step 3): Investigators review the actual email content, attachments, and any embedded links. This step helps understand the context and intent.

Recovering deleted email messages (Step 4): Deleted emails may contain critical evidence. Investigators use specialized tools to recover deleted messages.

References:

EC-Council Certified Security Specialist (E|CSS) documents and study guide.

EC-Council Certified Security Specialist (E|CSS) course materials123