3

So I'm working on a defamation case. So I will make a little overview of what is going on. The person we are trying to trace is using a site like kijiji. Tomorrow I am heading to the so said kijiji head office. They have been telling me that they don't keep any email headers and I know that's bullshit. The only thing I want to know is this. If you use a mailto form from the kijiji website, when the email is sent will the email header show the servers IP or the person who clicked send?

I've been seeing different information on different sites I've been doing my research on. Tomorrow is the day I have to go to head office to have access on computer and logs. What would you do out of this?

  • Surely they can see clearly the IP address of the server that was used by that message. – user45139 Oct 20 '15 at 15:19
3

Since it did not come from that persons email client or computer it is really all up to what they log about the user sending the email from the form. I would find it hard to believe that they would not have the IP address of the user logged, since they require many pieces of information. Please keep in mind that if the person is not a complete idiot they may have used a proxy and anonymous email service to hide their identity. Does the site use a relay? (Does not allow users to directly send email to each other) If it does then it complicates things further. In a nutshell, would their info be in the header? Most likely no. But they should be able to give you the IP address of the person that sent the message. Whether or not it will be their IP address or a proxy IP is unknown until you can actually get the IP from them if they hand it over. Don't focus on the mail header. It sounds like it will be useless. Ask to see their database records that stores the IP address related to a posting.

  • Alright I will add this to my presentation. So you are telling me to query the email that they put in. Like x@x.com. Thing is I havn't seen the database structure yet. Users on the site do not need to register like kijiji. The form is something of the sort: Product page with a mailto form - Name - Email - Message – darkspellx Oct 20 '15 at 15:10
  • 1
    If you know the email they used, they should have an IP associated with it. There should be some kind of link in the email/posting to point back to entries in the database. I guess it really depends on what they have stored in the database. I strongly believe they have the IP logged somewhere. They did have to enter an email address at some point, so the IP should be in some way attached with that information in the dataset. Finding the correct record should be able to be done through the information you already have. There should be some kind of key/link/id or something to point you to it. – David- Oct 20 '15 at 15:17
  • Will post my findings tomorrow and techniques used to try to find information. – darkspellx Oct 20 '15 at 16:43
  • @darkspellx How did it go? – David- Oct 22 '15 at 14:58
  • it's to bad but the IIS server logs where erased after x amount of days. And was not able to go on machines since the company had privacy policies. The fact that I did not represent a law enforcement led to a termination of our talk pretty quickly. – darkspellx Nov 5 '15 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.