Recovery of Mail Canceled Sending the Perspective of Memory Forensics - Park, Suin; Shon, Taeshik (2023 International Conference on Platform Technology and Service, PlatCon 2023 - Proceedings, 2023)
E-mail is mainly used by organizations such as businesses and schools for efficient work processing. Because it handles various tasks, most of the information related to the task is stored in e-mail. If important documents of a company are leaked due to mis-transmission of the e-mail, there is a possibility that the leaked documents may be abused. In preparation for such a case, the sender may cancel the transmission of the e-mail using the 'cancel transmission' function. However, if the recipient can restore the canceled e-mail, the sender cannot completely block the mis-transmission of the e-mail. In this paper, we analyze the e-mail storage structure stored in the e-mail data file and the storage structure of the unsent e-mail remaining in the file and attempt to restore the email.
Keywords: Datafiles; E-mail storage; Email clients; Memory forensics; Storage structures; Transmission function; Digital Forensics; Electronic mail; Email Client