5109 Metadata

razzia.hacking-lab.com
nm3.bullet.mail.ne1.yahoo.com (nm3-vm6.bullet.mail.ne1.yahoo.com)
tm3.bullet.mail.ne1.yahoo.com
omp1050.mail.ne1.yahoo.com
web121617.mail.ne1.yahoo.com

• parts that are under the control of the receiver (e.g. the received messages from razzia.hacking-lab.com) can be forged as well, but would stand out, as the receiver could identify forged data easily

• identify attachment part: marked with: Content-Disposition: attachment;
• copy encoded attachment to new file
• decode with specified encoding type: marked with Content-Transfer-Encoding: base64
  • base64 -d attachment > blackmail.docx

• metadata of email attachment: as one of parts of the email

    Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document                    
    Content-Disposition: attachment; filename="Blackmail.docx"
    Content-Transfer-Encoding: base64
  

• metadata of docx file: extract the docx (as it is essentially a zip file)
  • most interesting ones found in docProps/core.xml (everything in the extracted folder structure contains some metadata)

• location: word/document.xml