Covert communication by means of email spam: a challenge for digital investigation

Abstract

In digital investigations the investigator typically has to deal with thousands of digital artifacts. Among them, email has long been one of the many focuses that potentially can generate useful information. However, in our training we notice a tendency to overlook or downplay the importance of analyzing spam emails as they are generally assumed to be irrelevant junk emails. In this article we thus illustrate how these seemingly irrelevant messages might play a crucial role in digital investigations. Five scenarios are introduced in which the investigator tends to overlook crucial incriminating information that has been disguised as spam. The methods used by criminals in these cases are discussed. In light of these covert criminal communications, we call for more attention from the digital forensics community to realize how email spam may assist in criminal activities.