Analysis of Email Header for Forensics Purpose

Email is ubiquitous in the contemporary commercial environment, providing a convenient and efficient method for communication. However, involving email-related disputes and crime problems have become increasingly prominent. Many cases of inability to determine the authenticity result in a lack of effectiveness of the evidence. In order to determine the authenticity of email evidence, a scientific appraisal is very important. This paper analyzes the working principle of an email, discusses the construction mechanism of the keywords commonly used in the header field, and applies the analysis to forensic analysis.