When an average person sees an email, he can see only part of an information enclosed in the mail. To see full information one can look at the source of an email, which shows more. Example of an email source looks like this:
Received: via dmail-2008.19 for +INBOX; Tue, 3 Feb 2009 19:29:12 -0600 (CST) Received: from abc.luxsci.com ([10.10.10.10]) by xyz.luxsci.com (8.13.7/8.13.7) with ESMTP id n141TCa7022588 for <firstname.lastname@example.org>; Tue, 3 Feb 2009 19:29:12 -0600 Return-Path: <email@example.com> Received: from [192.168.0.3] (verizon.net [220.127.116.11]) (firstname.lastname@example.org mech=PLAIN bits=2) by abc.luxsci.com (8.13.7/8.13.7) with ESMTP id n141SAfo021855 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for <email@example.com>; Tue, 3 Feb 2009 19:28:10 -0600 Message-ID: <4988EF2D.firstname.lastname@example.org> Date: Tue, 03 Feb 2009 20:28:13 -0500 From: "Test Sender" <email@example.com> User-Agent: Thunderbird 18.104.22.168 (Windows/20081209) MIME-Version: 1.0 To: "Test Recipient" <firstname.lastname@example.org> Subject: Example Message Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Comment: Lux Scientiae SMTP Processor Message ID - 1233710941-9110394.93984519
My question is: what kind of information can a skilled person get from an email source in two cases:
- a person who sends an email has no knowledge of computer except sending mails/browsing internet
- a person who sends an email is skilled and want to hide/change as much as possible, but does not have too much control (by too much control I mean he does not have control over big email services, but can have his own email server)
- I am not talking about this specific example (it is just for people who do not know about email source).
- I know that some of the fields can be changed by sender (but I do not know how many of them could be changed).
- I can read, so I see that I can find through which email provider an email was sent, at what time, through which program. But I am curious whether I can get information which can narrow down possible user (may be his OS, IP, timezone and so on)