Recovery of Mail Canceled Sending the Perspective of Memory Forensics

Abstract

E-mail is mainly used by organizations such as businesses and schools for efficient work processing. Because it handles various tasks, most of the information related to the task is stored in e-mail. If important documents of a company are leaked due to mis-transmission of the e-mail, there is a possibility that the leaked documents may be abused. In preparation for such a case, the sender may cancel the transmission of the e-mail using the 'cancel transmission' function. However, if the recipient can restore the canceled e-mail, the sender cannot completely block the mis-transmission of the e-mail. In this paper, we analyze the e-mail storage structure stored in the e-mail data file and the storage structure of the unsent e-mail remaining in the file and attempt to restore the email.