The Design and Implementation of Email Investigation and Analysis System

随着信息网络的高速发展，电子邮件作为一种快捷便利的通信手段，已经深入普及到人们的日常工作与生活中，其间蕴含着丰富的个人信息，是进行计算机调查取证的重要途径，能为案件侦破提供有力的线索。电子邮件客户端为邮箱用户提供了友好的管理界面，受到网民的普遍青睐，使用率高，其保存的邮件数据文件也是调查取证的重要对象，挖掘分析其中的有用线索是计算机取证的重要手段。 本文研究的电子邮件调查分析系统主要是针对MicrosoftOutlook和OutlookExpress这两种常用的电子邮件客户端软件，通过解析客户端下保存的邮件数据文件，即从Pst、Dbx两种格式的邮件存储复合文档中提取相关邮件的收发帐户邮件地址...Along with the rapid development of information network, E-mail, as an important and quick means of communication, has been deeply into people’s daily work and life. The rich personal information contained inside is significant for investigation and evidence collection, providing important clues to handle cases. E-mail clients offer a friendly user interface, generally favored by netizens. The mai...学位：工学硕士院系专业：信息科学与技术学院自动化系_系统工程学号：2005130248

DBX mail file parsing based on COM technology

电子邮件客户端Outlook Express下保存的邮件数据文件,蕴藏着丰富的个人信息,挖掘分析其中的有用线索已成为计算机调查取证的重要手段和研究方向,而首要条件就是需要对这些经过编码的数据文件进行解析,将所有的邮件信息还原出来。针对此问题,提出了一种利用Outlook Express提供的COM组件接口对这些邮件数据文件直接进行解析处理的方法,避免了研究其编码及内部逻辑架构的繁琐。The E-mail data files kept by Outlook Express (OE) contain the rich personal information. So mining and analyzing the useful clues inside has become a significant means and research area for the computer investigation and forensics. The foremost is to parse the encoded data files, and then restore all the mail information. Aiming at the problem, a solution that we adopt the COM component interfaces of OE to parse these mail data files was presented, avoiding the troubles of research on their encoding format and complex internal logical structure.国家“十一五”科技支撑计划项目(2007BAK34B04);; 国家自然科学基金资助项目(60704042);; 厦门大学985二期信息创新平台项目(2004-2007

PST File Parsing Based on OLE Automation Technology

为直接解析客户端软件OuTlOOk的数据文件,分析其内在编码及逻辑结构,提出一种基于OlE自动化技术的PST文件解析方法,通过启动OuTlOOk自动化服务器,创建OuTlOOk自动化对象,利用OuTlOOk提供的相关接口函数直接获取文件中的邮件信息。实验结果表明,该方法能够获得良好的效果。In order to parse the data files kept by Outlook directly,its internal code and logic structure are analyzed,and a PST file parsing method based on OLE automation technology is proposed.By starting Outlook automatic server,the corresponding object is set up.The post information is got by using relevant interface function provided by Outlook.Experimental results show this method can get better effect.国家“十一五”科技支撑计划基金资助项目(2007BAK34B04);国家自然科学基金资助项目(60704042);厦门大学985二期信息创新平台基金资助项目(00002X07204