How can I track an email?

[BlueSideUp]

A client sent an email cancelling service but he says the email did not come from him. The email address was different but included details only he would know, and how many of us have just one email address these days?

Is there any way to find out if both emails originated from the IP? Either the mail was his and a mistake or someone is posing as the client.

[jriera]

Most email clients have the option to see all the route trace for a particular email. I.e. in Outlook 2003 right-click on the message and select Options, you will see the route under Internet headers ...

Good luck!

[Scott R]

If its Outlook right click on the message and select "options" You will see an "internet headers" box, tat will show the origin. This is an example from Pelican:

X-McAfeeVS-TimeoutProtection: 0
Received: from imta11.westchester.pa.mail.comcast.net ([76.96.62.22])
by alnrmxc15.comcast.net (alnrmxc15) with ESMTP
id <20080408230131a1500qauh6e>; Tue, 8 Apr 2008 23:01:32 +0000
X-Originating-IP: [76.96.62.22]
Received: from forums3 ([66.236.61.177])
by IMTA11.westchester.pa.mail.comcast.net with comcast
id BB1X1Z00G3pSn3W0B00000; Tue, 08 Apr 2008 23:01:31 +0000
X-Authority-Analysis: v=1.0 c=1 a=kqjBEHjpPHgA:10 a=HGQqBogPaDMA:10
a=gKPyFdH5AAAA:8 a=fnsouu0WrPoVgRjGti0A:9 a=FiBSY2hboLvHKQRoSHkA:7
a=5KpkJH_K315Bm6lpxc5E-B8u0WIA:4 a=9OHTkwyHC8cA:10
Received: from forums3 ([127.0.0.1]) by forums3 with Microsoft SMTPSVC(6.0.3790.3959);
Tue, 8 Apr 2008 16:01:30 -0700
Date: Tue, 08 Apr 2008 16:01:30 -0700
Subject: Reply to thread '
From: "Pelican Parts Technical BBS"
Return-Path: pelicanforums@pelicanparts.com
Auto-Submitted: auto-generated
Message-ID: <200804082330.d32065402822@forums.pelicanparts.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
X-OriginalArrivalTime: 08 Apr 2008 23:01:30.0546 (UTC) FILETIME=[7B8FD120:01C899CC]

[Gogar]

In Mac OS Mail, select the email and do:

>View >Message >Long Headers.

Good luck!

[jeffgrant]

Just be careful that you don't put too much faith in that information in the headers... if the sender knew what they were doing, it would be fairly trivial to fake that information.

Also, it could very well have been sent from his machine... if his machine is compromised, someone other than him could have hacked into it and sent that email, and would probably have access to all of the other emails on that system (and therefore the detailed information you're referring to).


Case in point: In one of my old apartments, we were all wired for high-speed internet. One of the neighbours had his box hacked, and was saturating all of our bandwidth with spam, warez ftp servers, etc.

I ended up hacking into the box and finding his resume, and called him at work to ask him to please fix his box as it was hacked, yada yada.

He was totally unaware that it had happened, other than "it felt slow for the last few days". He was also freaked that I'd been able to get into his personal info on it. He then had me over for beers to clean it up and secure it for him.