Forensic, Attribution & Evidence Integrity Briefings
Longform technical briefings authored from 25+ years of District Attorney’s Office digital forensics and cyber response experience.
Email Header Analysis: Reading the Route
A printed screenshot or PDF of an email body omits the most important technical evidence: the full RFC-5322 message header. While display names and "From" lines are trivially forged, the transit headers recorded by receiving mail servers preserve a bottom-up chronological ledger of how the message actually traveled.
In our OSINT and forensic reviews, we examine headers in context rather than treating a single field as conclusive:
- Transit Hops (Received Lines): Reading from bottom to top to trace the message path across originating clients, relay hosts, and recipient MX gateways, while accounting for webmail or API-based submission where client IPs may be masked.
- Cryptographic Authentication: Evaluating SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) cryptographic signatures, and DMARC alignment to determine whether a domain genuinely authorized the transmission or if header spoofing/modification occurred in transit.
- Timestamp & Timezone Skew: Normalizing UTC offsets across server hops to spot fabricated chains, delayed relays, or backdated local client clocks.
Whether evaluating a disputed business communication, a phishing pretext, or an alleged threat message, proper header analysis establishes what the technical routing record actually proves—and where carrier or provider logs are needed to complete attribution.
Digital Evidence & The Jury: Bridging the Clarity Gap
How to present complex forensic findings to a jury without losing them in technical jargon, ensuring the "facts of the case" remain the focus.
Cellebrite Deconstructed: Logical vs. Physical Extractions
A deep dive into why relying on a standard "Logical" report can lead to devastating omissions in criminal defense cases.
The Invisible Chain: Maintaining Forensic Soundness
Why "Chain of Custody" is more than just a piece of paper, and how technical missteps during collection can invalidate entire cases.
IP Address Geolocation: Fact vs. Forensic Fiction
Explaining why an IP address is rarely a "physical address" and how prosecution experts often overstate location accuracy.
Metadata: The Digital Fingerprint of User Intent
Analyzing the "Data about Data" to prove whether a file was intentionally created, moved, or automatically generated by the system.
Deleted Data Recovery: What is Actually Possible?
Setting realistic expectations for recovering "purged" communications from modern mobile and cloud-based systems.
The Art of the Rebuttal: Strategies for Cross-Examination
How to dismantle a prosecution expert’s technical testimony by identifying overstatements and methodological shortcuts.
Cross-Platform Artifact Correlation: The Unified Timeline
Using cloud, mobile, and wearable data to reconstruct a defensible unified timeline that contradicts isolated evidence claims.
Email Header Analysis: Reading the Route
How RFC-5322 routing hops, cryptographic authentication signals (SPF, DKIM, DMARC), and server timestamps separate genuine origin from spoofing.