this post was submitted on 21 Mar 2024
2 points (75.0% liked)

Digital Forensics

289 readers
1 users here now

A community focused on all things digital forensics.

founded 1 year ago
MODERATORS
 

I received several machine-generate e-mails which are all mostly the same: a notification. They are HTML emails with no plaintext MIME part. Yikes! And to complicate matters further, the messages traversed my anonaddy forwarding account which PGP encrypts every message to me before forwarding it to my normal email account.

The gov wants me to give them an “unaltered copy” of these e-mails. This gov office actually blocks my mail server so I am generally unwilling to send them email. This means I will be giving them the emails on paper hardcopy.

So wtf, this is tricky. They want an “unaltered copy”. If I were to print the MBOX files, it would be useless to them because it’s a base64 blob that only I can decrypt. My mail client is mutt so the HTML is detected and piped through w3m to give me a text version that is readable enough.

But in general, how do you give unaltered copies of an HTML email on paper form? This is not necessarily for a court but it could go down that path. Would a court want to see raw HTML tags? Or do courts prefer the HTML to be rendered for readability?

Normally I copy the w3m-rendered text of email into LaTeX and typeset it to look pretty and copy-paste the useful headers into a well-styled header in a monospaced font. And I omit the useless headers. But I get the impression my way of working would not pass for “unaltered”.

I could perhaps try to feed the HTML into wkhtmltopdf. In the end, HTML rendering always varies depending on the rendering tool. Normies use MS Outlook, and I have to figure that the gov is normally dealing with normies. So maybe I should install Evolution or Thunderbird. Any suggestions for a tool that is particularly good at making HTML email presentable on paper without looking too custom?

#askFedi

you are viewing a single comment's thread
view the rest of the comments
[–] thebardingreen@lemmy.starlightkel.xyz 2 points 7 months ago* (last edited 7 months ago) (1 children)

I'd kind of forgotten how I'd done it.

This script searches an MBOX file for emails from or too lawyer1 and lawyer2, that contain the names or email addresses in target_names. It exports each email to a txt file, and saves any attachments in their original format.

https://pastebin.com/i0xq4fP9

Then I used this bash script to export the txt files to PDF, using pandoc (https://pandoc.org/)

https://pastebin.com/17FPXPr5

In my case, we needed to export like 7,000 emails from over a 6 year period from like a 45 GB GMail MBOX export. The lawyers seemed happy with the result, but it was a lot of data.

[–] coffeeClean@infosec.pub 1 points 7 months ago (1 children)

Thanks! I grabbed it in case it comes in handy. I wonder if the first script which searches for messages might have been simplified by using grepmail. Grepmail is slow but powerful.