Forensic Review of Gmail Message to Find What Time It Was Sent

In his blog post of June 17, 2020, the great Craig Ball discussed how to determine the precise time that a gmail message was sent by reviewing the original code of the message. This can help clear up confusion caused by email threads between people in different time zones. Here's a rundown of how to do this.

1. In an email message sent from a gmail account, select the drop-down menu by clicking on the three dots to the right of the message's header, and then select 'Show original'.

2. This will open the raw code for the message. Review the code for references to a timestamp. You should be able to find these by searching for the tag, "t=". The value following this tag measures the number of 100 nanosecond intervals between the precise time the message was sent and midnight on January 1, 1601. Windows uses this arbitrary date (or the date of the first full century since the adoption of the Gregorian calendar) as a yardstick. In this example we find the number, '1594755105' used as a time code.

3. On the site of Dan's Tools, there is an epoch timestamp converter. When the number 1594755105 is entered it gives the precise time of July 14, 2020, 19:31:45 UTC.

Data Stored on Photocopiers

Keep in mind that a photocopier contains a hard drive that will store images of documents that have been photocopied, scanned, or faxed. It's important to confirm that copiers used by law firms and businesses encrypt data on these hard drives, so it cannot be accessed without special software. Some copiers can be set to overwrite data after each job, or at set intervals.

Xerox has published a guide that indicates which of its current models has a disk drive; which overwrite data immediately or at intervals; and which encrypts data on the hard drive.

Nearly all of the models with drives, also provide AES data encryption. Many Xerox copiers overwrite images automatically by default. The manual states that Xerox's overwriting process conforms to the National Institute of Standard and Technology's Special Publication 800-88, Guidelines for Media Sanitization. An overwrite process can also be activated that will wipe data on every sector of the hard drive.

A Xerox technician can remove the hard drive from a copier and provide it to a client upon request.

Images are not overwritten on copiers using solid state drives.

Implementing a Litigation Hold in Office 365

Microsoft 365's Core eDiscovery tool allows litigation holds to be placed on Outlook mailboxes; SharePoint; OneDrive; and Teams accounts. You can avoid adding the URL of each OneDrive site, and adding mailboxes one by one, by making use of a PowerShell script posted on the Core eDiscovery reference guide here. For a selected domain, the script can use email addresses to locate mailboxes. Up to 1000 different email addresses can be used.

The script prompts the admin to enter a search query. The hold can be limited to data that meets particular search criteria.

It's necessary to create a text file with a list of email addresses the script will process.

The script generates logs of the locations of mailboxes and OneDrive sites that are on hold and are not on hold.