How I recovered a lost email from my email client’s memory
1–10 of 85 posts
Re: How I recovered a lost email from my email client’s memory
#2I misread this as: "I recovered a lost email from my client’s memory". It made me think of the Black Mirror episode 'Crocodile', and I was quite amazed. Then I saw 'email' client... haha
Re: How I recovered a lost email from my email client’s memory
#3Of course recoverin an email is an innocent disguise.
The same approach works for recovering any secret information that people used on a computer that an attacker can access. Of course there are plenty of possibilities. But it’s eye opening to see them in action.
Re: How I recovered a lost email from my email client’s memory
#4[deleted]
Re: How I recovered a lost email from my email client’s memory
#5> There are specialized tools you can use to analyze this data blob.
These are called file carving tools and two better known ones are foremost and it's successor scalpel [1].
Re: How I recovered a lost email from my email client’s memory
#6Of course recoverin an email is an innocent disguise. The same approach works for recovering any secret information that people used on a computer that an attacker can access. Of course there are plenty of possibilities. But it’s eye opening to see them in action.
Yes, encryption keys can persist in memory, too. That's why many law enforcement agencies use something like a HotPlug[1] + mouse jiggler to keep machines powered on when executing a search warrant.
[1] https://www.cru-inc.com/products/wiebetech/hotplug_field_kit...
Re: How I recovered a lost email from my email client’s memory
#7Does anyone know of a good Linux email client that isn’t crippled by show-stopping bugs of this sort? I used Mailspring for a while, which has a nice modern interface, but quit after discovering that my drafts were only saved locally, not on the server. This has been an open bug for at least two years.
In the end I’ve always fallen back to Thunderbird as the least bad option.
Re: How I recovered a lost email from my email client’s memory
#8Of course recoverin an email is an innocent disguise. The same approach works for recovering any secret information that people used on a computer that an attacker can access. Of course there are plenty of possibilities. But it’s eye opening to see them in action.
Yes, eye opening. Non IT folks often believe they are safe because no one will find their secrets in a fast sea of information anyway. Nothing can be farther from truth. Most of the time key material and other secrets can be extracted automatically using widely and freely available tools.
Re: How I recovered a lost email from my email client’s memory
#9> There are specialized tools you can use to analyze this data blob. These are called file carving tools and two better known ones are foremost and it's successor scalpel [1]. [1] https://github.com/sleuthkit/scalpel
Scalpel, as good as it was back in its time, sadly has been stalled. Carrier and/or the folks in charge of The Sleuth Kit have taken it into their github repo[0] but there haven't been commits for ~7 years now.
I did a thesis on file carving some 10 years ago, and scalpels ideas where very good back then. Photorec[1], however, has been the gold standard for a long time on (open source) file carving. It can handle text based formats way better (scalpel is severely limited in this aspect due to the "header/footer" paradigm), and is a wonder with stream based formats (that can have boundaries on the bit level).
And it's not because they authors weren't good[2], I think what mainly happened is that they didn't have the time to keep maintaining the software they created (I know that has happened to me more than once).
There are also some commercial file carving tools, though most are aimed at having better integration with forensics software (like Encase, FTK, Oxygen, etc) or automate parts of the process, like document analysis. Still, if you just want to compare them by their ability to recover files, I'm pretty sure Photorec makes it to the top.
[0] https://github.com/sleuthkit/scalpel
[1] https://www.cgsecurity.org/wiki/TestDisk_Download (PhotoRec is part of TestDisk)
[2] They're some of the best in the field of digital forensics
Re: How I recovered a lost email from my email client’s memory
#10nano ftw.
Modern web email clients have this since a long time and Gmail never crashed internally for me ;)