Skip to content
MessagingFORENSICS

Posts tagged: #dfir

← Back to all posts
Email Header Forensics: Received, SPF, DKIM and MIME
Read Received chains bottom-up, compare Return-Path, From and Reply-To, interpret SPF/DKIM/DMARC results and decode MIME across EML, MBOX, MSG and PST.
emailheadersspfdkim
Microsoft Teams Forensics: Purview, Graph and Cache
Acquire Teams chats via Purview eDiscovery, the Microsoft Graph chatMessage API or a Teams (free) export, and know which fields, edits and deletions matter.
teamsmicrosoft-365purviewediscovery
Slack Export Forensics: ZIP Layout, ts and Tombstones
What a Slack workspace export contains, how to read ts, thread_ts, edits, tombstones and message markup, what exports leave out, and how to verify integrity.
slackexportediscoverydfir
What Is Messaging Forensics? A Practitioner's Primer
Messaging forensics explained: acquisition options, a normalized message model, the timestamp zoo, evidence hashing and the pitfalls that break timelines.
fundamentalsdfirmessagingtimeline