CAT_03 // HEADER_FORENSICS // PI SUBCONTRACTING SUBPAGE
Email Header Analysis
Read routing data, authentication signals, timestamps, originating infrastructure, and other header evidence in context—not as isolated fields.
When your client receives anonymous threats, harassment, or suspected spoofed correspondence, the visible "From" line cannot be trusted. We analyze the full RFC-5322 message header to trace the transit route, verify cryptographic signatures, and isolate originating network indicators.
KEY QUESTIONS THIS INVESTIGATION ANSWERS FOR YOUR CASEWORK
- Did this email genuinely originate from the sender’s domain, or was the address spoofed?
- What originating IP address or mail relay injected the message into the transit path?
- Do the server hop timestamps and timezone offsets reveal the sender’s client environment or schedule?
ANALYTICAL BOUNDARY & LIMITATIONS
Major webmail providers (e.g., Gmail, Outlook) often mask the sender’s home IP address in outbound headers; we identify exactly what the header reveals and what remains masked.