2

Ran a recovery program (Kroll Ontrack) on a Windows 7 PC and recovered many, many emails. Almost all of them open in my Windows 10 mail client (and Thunderbird), except for a handful from this March. They look like the image above, and even some are blank. These are not empty files, though, as they have file sizes ranging from a few KB to 16 MB. Incidentally, these are the most important emails. Is this a sign of a .eml being encrypted? Or is it something else? And all of the other emails have perfectly fine images, docs, PDFs, etc. Just these handful from March look like this.

image

I'm not asking how to decrypt these, I just want to know if a series of emails that look similar to this is a sign of them being encrypted in the first place.

  • 1
    Hard to tell just from looking at this image. The source of the mail (i.e. the contents of the .eml file opened with notepad) would probably provide the necessary information. – Steffen Ullrich May 23 '16 at 4:31
5

They are standards for encryption of mails, notable S/MIME and PGP. There is defined how the encrypted message gets encapsulated so that the mail client knows that it is encrypted. These encapsulations have a very specific Content-Type headers or at least specific markers in the content, i.e. markers like

 -----BEGIN PGP MESSAGE-----

or Content-Type's like

  Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";
  Content-Type: application/pkcs7-mime; name=smime.p7s

If you find any of these when looking at the source code of the message then the message is encrypted. If not then the message is probably corrupted. The source code of the message can be seen when opening the .eml file in notepad or similar or if you are using the appropriate function of the mail client (if there is such function).

4

Encrypted data should have a relatively uniform distribution of randomness, so if notable portions of it fed through tests such as a chi-squared test don't end up showing as random, then it's unlikely it's encrypted.

Since you have multiple messages, close attention to the first bytes of each message is also relevant because it'll give a chance to detect a pattern in headers such as a magic number or key identifier.

https://www.random.org/analysis/ will be able to provide some insight. As for automated tooling, some research may be needed to answer that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.