CHFI (312-49) Digital Forensics Simulation
Investigation Scenario
A major healthcare organization in Chicago has reported a targeted phishing campaign attempting to harvest employee credentials for the VPN portal. The Incident Response team has secured the workstation of a compromised user, generated an E01 disk image, and extracted the user's OST/PST files. You have been assigned as the primary forensic investigator to analyze the extracted emails, identify the true origin of the attack, and attribute the infrastructure to assist in blocking the threat and supporting potential legal action.
Evidence Collected
Forensic extraction using FTK resulted in the isolation of several malicious `.eml` files. Below is an excerpt of the SMTP headers from phishing_evidence_001.eml (MD5: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6):
Note: The earliest "Received" header (closest to the bottom in a full header, but the primary external handoff shown here) indicates the injection point of the email into the organization's MX server.
Question
During an investigation into a suspected phishing campaign at a healthcare organization in Chicago, forensic analysts are examining email headers to trace the origin of the malicious messages. They identify a suspicious IP address in the "Received" field of one of the emails. To determine the geographical location and owner of this IP address, which tool or service should the analysts use?
Expert Analysis
- What evidence shows: The SMTP header clearly shows the handoff from
mail.secure-update-health.netresolving to IP192.0.2.45. The domain is likely spoofed or a typosquat, but the connecting IP is a factual routing artifact recorded by the receiving MX server. - Identify forensic stage: Examination and Analysis (specifically, Network and Email Forensics).
- Why correct answer is correct (WHOIS): WHOIS is a query and response protocol used for querying databases that store the registered users or assignees of an Internet resource, such as a domain name or an IP address block. It provides the geographic location, ASN, hosting provider, and administrative/abuse contacts required for further investigation or legal subpoenas.
- Why others are wrong:
- NSLOOKUP: Only resolves DNS names to IP addresses (or vice versa via reverse lookup). It does not provide ownership or geographical allocation data.
- TRACERT: Traces the network pathway (routing hops) between the investigator's machine and the target IP. It maps topology, not ownership.
- IPCONFIG: A local command-line tool used to display the current TCP/IP network configuration of the investigator's own Windows machine.
- Real-world forensic action: The investigator would execute a WHOIS query against
192.0.2.45, screenshot or pipe the output to a text file, calculate a hash of that text file to preserve its state, and include the findings in the formal forensic report to initiate takedown requests with the identified ISP.
MINI LESSON: Email Header Forensic Workflow
When analyzing email evidence, never trust the "From" or "Return-Path" headers, as they are easily spoofed by attackers. The only cryptographically and logically sound data points are the Received headers appended by each Mail Transfer Agent (MTA) along the delivery path.
Workflow:
- Read "Received" headers from top (most recent) to bottom (oldest).
- Identify the boundary where the email entered the victim's controlled infrastructure.
- Extract the external IP address that handed the message to the internal MX server.
- Perform WHOIS on that external IP to determine infrastructure attribution.