3

So I'm working on a defamation case. The person we are trying to trace is using a site like kijiji. They have been telling me that they don't keep any email headers and I know that's not true. If you use a mailto form from the kijiji website, when the email is sent will the email header show the server's IP or the person who clicked send?

I've been seeing different information on different sites I've been doing my research on.

Improve this question
1
  • Surely they can see clearly the IP address of the server that was used by that message.
    – user45139
    Commented Oct 20, 2015 at 15:19

1 Answer 1

Reset to default
4

Since it did not come from that persons email client or computer it is really all up to what they log about the user sending the email from the form. I would find it hard to believe that they would not have the IP address of the user logged, since they require many pieces of information. Please keep in mind that if the person is not a complete idiot they may have used a proxy and anonymous email service to hide their identity. Does the site use a relay? (Does not allow users to directly send email to each other) If it does then it complicates things further. In a nutshell, would their info be in the header? Most likely no. But they should be able to give you the IP address of the person that sent the message. Whether or not it will be their IP address or a proxy IP is unknown until you can actually get the IP from them if they hand it over. Don't focus on the mail header. It sounds like it will be useless. Ask to see their database records that stores the IP address related to a posting.

Improve this answer
5
  • Alright I will add this to my presentation. So you are telling me to query the email that they put in. Like [email protected]. Thing is I havn't seen the database structure yet. Users on the site do not need to register like kijiji. The form is something of the sort: Product page with a mailto form - Name - Email - Message
    – darkspellx
    Commented Oct 20, 2015 at 15:10
  • 1
    If you know the email they used, they should have an IP associated with it. There should be some kind of link in the email/posting to point back to entries in the database. I guess it really depends on what they have stored in the database. I strongly believe they have the IP logged somewhere. They did have to enter an email address at some point, so the IP should be in some way attached with that information in the dataset. Finding the correct record should be able to be done through the information you already have. There should be some kind of key/link/id or something to point you to it.
    – David-
    Commented Oct 20, 2015 at 15:17
  • Will post my findings tomorrow and techniques used to try to find information.
    – darkspellx
    Commented Oct 20, 2015 at 16:43
  • @darkspellx How did it go?
    – David-
    Commented Oct 22, 2015 at 14:58
  • it's to bad but the IIS server logs where erased after x amount of days. And was not able to go on machines since the company had privacy policies. The fact that I did not represent a law enforcement led to a termination of our talk pretty quickly.
    – darkspellx
    Commented Nov 5, 2015 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .