How to Analyze & Download G Suite Email for Forensics Investigation Purpose

By the advancement of the technology the users are starts to completely depend on the web based technology to store and share the electronic data. Google Apps/ G Suite is such a platform which comprises with cloud computing, productivity and collaboration tools, software and products developed by Google. Increase in the use of Google services demand the forensic extraction of G Suite data through proper analysis. To download G Suite/ Google Apps email evidence in court acceptable format is the basic challenge facing by the investigator after the successful acquisition of email evidence.

Forensic Solution for Google Apps Accounts

G Suite provides web based Gmail service with a large amount of storage space, threaded conversation, and efficient search capability. Most commonly G Suite email service is used for the business/ professional purpose. Which allows to access powerful Google applications like Gmail, Calendar, Docs etc. Google Apps help the users to more professionalize their email by providing access to your preferred domain (your_name@your_company.com) and 30 GB of Google drive storage.

Google Apps provide Administrator account and User account. G Suite administrator account consists of the admin console which manages all G Suite services like add or remove users, devices management, Security settings, Data migration etc. During the forensics acquisition of Google Apps data, the administrator permission is an important factor for the user account analysis and to download Google Apps email data.

G Suite Administrator Roles

• Super Admin: This role has access to all admin console and Admin API, and can manage every feature of organization account. It can also allow the user to print or download G Suite email from their account.
• Group Admin: It has full control over all google groups created in the Admin console. They can also view the user profile and organizations structure.
• User Management Admin: They can perform all actions on the users who are not administrators through Admin console and Admin API.
• Help Desk Admin: Help desk admin can reset the password of the users and they can only read the organization units.
• Services Admin: This admin allows to manage certain service settings and devices added to the Admin console.
• Reseller Admin: They have the provision to manage resold customers and have the access to reseller console, administrator console for their customers domain and reseller related API.
• Mobile Admin: They can manage mobile devices in admin console. They are allowed to provision and approve devices, whitelist apps, block and wipe devices and accounts etc.

G-Suite User Relevance

If all the members in your organization need to get access to your organization’s Google services. First, you need to create user account for each member with separate user name and password. The G suite allows to add each user individually and add several users at once through CSV file with their names. The easiest way to add users into admin console is adding user individually. The google apps also provide the option to allow the users to manage the task in admin console by providing one or more administrator roles. The users assigned with the administrator role can access admin console through their account.

Before understanding the ways to download Google Apps email in court acceptable form. We can see how forensically analyze Google Apps email data.

How to Perform Google Apps Email Forensics

Analysis of Gmail Email Data will help the Investigators in forensics acquisition of Google Apps evidence. The user and administrator can perform the manual forensic analysis on their Gmail account through the following steps.

• Sign in to G Suite account.
• Open Gmail service from your apps section.
• Choose and open the email message that wants to analyze.
• Click on the more option button and select Show original option.

This will provide three sections to analyze the email message. They are:

Original Message: This will provide information such as “Message ID, Created at, From, To, Subject, SPF, DKIM”. It can be considered as the brief information of email message without body message.

Header data: This section will provide the complete header information of email data. Google Apps mail header analyzer help to extract all email message related information such as sender& receiver information, date, time, Used device, IMAP version, and other similar data.

Message body: This section provides the original email message that used to communicate between the sender and receiver.

Query: “I have been working as a forensic investigator over a few years. During my last investigation, I got a case to investigate on a suspected Gmail account of a large business firm. Which having thousands of emails related to the suspected situation. After the detailed analysis on that account, I found a bulk set of emails that can be directly present as evidence in the court. The normal method that we all follow to submit email data in court is either take print of those emails or generate it in PDF format. But during a short period of time, it is not an easy process to print that much amount of emails separately. Can you suggest me any forensic utility that can download G Suite email evidence in court acceptable format.”

Do you have similar queries related to Google Apps forensics or downloading Google Apps email evidence. Then you are in the right place. In this blog, we are going to explain the solution for the above with the help of the best forensic investigation tool MailXaminer. Follow the bellow section to successfully download email from G Suite.

Extract & Download Google Apps Email Evidence Through Forensics Investigation Tool

For the forensics acquisition of data add G Suite account into the Email Forensics Tool. Click on the Add New Evidence button and select G Suite option from the Cloud section. Investigator can directly access the email data from the Google user account and admin account by providing the User Name and Password in the respective fields.

The tool also provides the option to Date Filter for accessing the data between the particular dates. This will help to reduce the loading time and analysis processes.

Investigator can easily analyze email data through different views such as Message, Hex, Property, Message Header, MIME, HTML, RTF and Attachments. Each of the views provides the various information related to the particular email data which will help the examiners/ investigators to deeply analyze the data and carve the evidence hide inside.

After the analysis of email data most of the forensic investigators facing difficulties in download G Suite email and direct presenting it in court. During the court procedure, electronic data is not acceptable in their original form. When handling a large amount of data generating the court admissible format within the available time is a challenge for the forensic investigators. This digital forensics investigation provides the best option for handling this kind of situation. The tool allows to selectively export/ download email from G Suite into various file format like “PST, PDF, EML, HTML, MSG, CSV etc”. According to the purpose of email evidence the investigator can choose the appropriate file format.

For the bulk export of email data, the tool provides the option to export email data in folder wise. Click on the export button on the software and select the Folder Export button to export complete folder data together. This will reduce the time of selecting and download google emails separately. Through the Export setting option user can provide addition settings like Maintain Folder Hierarchy, Exclude duplicate, Naming conversions, CSV header setting, PDF setting etc. During the court procedure of email investigation the PST and PDF are the court admissible file format to present the email evidence. Because of the un-editable nature of PDF the most of the experts try to download G Suite email evidence in the PDF file format. The forensics tool allows the user to download Google Apps email in PDF file format with attachments in three ways such as “Attachment on pin, Append attachment, Save attachment native format”.

Final Words

Download G Suite email data and Generate email evidence in the court admissible form in a timely manner is a challenging process for the Forensic Investigators. The manual method for analysis and forensics extraction of g suite email evidence from the admin and user account is a time consuming and tiring process for the examiners. It is advised to take the help of a Digital Forensics Tool for proper analysis and download of G Suite data for generating court admissible evidence. It is the best and most recommended solution to generate email evidence in court accepting format.