VP-03 · Email forensics

Email headers and a message-trace export: a payment change under review

A raw e-mail asking an accounts clerk to pay an invoice to new bank details, the supplier's earlier message for comparison, and a message-trace export of the clerk's mailbox. Thirteen questions lead from file integrity and the trace lines to the times in the export and to what the export cannot show.

Synthetic training data. The organisation, people, devices, serial numbers and times are invented.

01Brief

Heron Yapı Malzemeleri Ltd. Şti. buys steel sections from Cedar Steel Supply. On Monday 16 March 2026 the mailbox ap.clerk@heron-yapi.example, used by accounts payable, received a message from accounts@cedar-steel.example. It asks that invoice 2026-0412 be paid to new bank details. The finance manager asked internal audit to check the message before any payment. Internal audit received the raw message, the supplier's earlier message of 12 March 2026 for comparison, and a message-trace export of the mailbox for 12 to 16 March 2026. The attachment named in the message is not part of this pack.

Internal audit asks:

Did the message enter Heron's mail system through the supplier's own server?
Which record links the export to this message, and when did the gateway receive it, in UTC?
Can the headers and the export show who sent the message?

Answer from the files only: what the headers record, what the export records, and what they cannot show. Do not decide who wrote the message, whether the supplier's account was compromised, or what anyone intended.

02Evidence files

File	Contents	SHA-256
README.txtScenario and file list	The brief in English and Turkish, the rules, and what the pack does not contain.	cda3f32509a9227b7f21f62655192fba72623d3704fd68f6d0a8d0812d45cf93
acquisition-log.txtCollection log	What was collected, from where, on which clock, and the SHA-256 values recorded at collection.	9766c1fc95982863f54f890766e120559dab3075d64abc2f5b36e063c12ebde9
export-metadata.txtExport parameters	Query window, row limit, rows returned, the time basis of each column and the scope of the export.	e18bfac3ec8c4ee1828358c18d5fa9276ce37b4d48eda4368c98decc5abe82c5
cloud-export.csvMessage-trace export	Six records of the mailbox in the window, with times in UTC, the Message-ID and the client address.	bcfa4bdfe7000b88999c8a00a2b3a58e8ba1b84828527fbde5ff115d56301729
message-disputed.emlRaw message: disputed	Headers and body of the payment-change message. The attachment it names is not included.	45b020315b5c527fbf7cb010deeeef078bc7635cc21afa6a891f68868554647e
message-previous.emlRaw message: earlier, same supplier	Headers and body of the supplier's invoice of 12 March 2026, for comparison.	e3d675fc4d117cbecf74ab35eb85fda340ef05fb770613f33e89d0199c8802d3
manifest.txtHash manifest	SHA-256 of every file above except itself. Verify before you start.	(the manifest itself)

The hashes above are copied from manifest.txt. Recompute them yourself, for example with the hash tool or sha256sum.

03Before you start

Verify every file against manifest.txt and write the result in your examination log before you read anything else.
Work on copies. Read the Received lines from the bottom up: the lowest line is the earliest hop the file records.
Convert every time to UTC before you compare. A header with +0300 and a UTC column describe the same instant only after conversion.
A header is a statement made by a message or a server. It is not proof of who wrote the message. Record what it says and what it cannot show.

Keep your notes in F-02 Evidence intake form and F-04 Examination log.

04Questions

Answer from the files only. Each answer is checked in this browser; nothing is sent anywhere, and your answers are kept on this device until you clear them. 13 questions, 20 points.

Score 0 / 20

05Your finding

Last step: write one paragraph that answers the three audit questions as a finding. Your instructor marks it against four criteria:

The report lists each Received line with its server and its UTC time, from the bottom up.
Every time carries its basis: UTC, or local time with its offset.
The report states what the headers record and does not name who sent the message.
Each claim names its file and line, and the report states what the export does not cover.

How findings are phrased →

VP-03 · Email headers and a message-trace export: a payment change under review

Name: ______________________ Date: ____________ Start / end (UTC): ________ / ________

Synthetic training data. Answer from the files; for each answer write the file and row that supports it.

Q01 (1 pt) On a copy of message-disputed.eml, compute the SHA-256 value, compare it with manifest.txt, and enter the first eight hex characters.
Answer: ____________________________________________
Source (file, row): ________________________________
Q02 (2 pt) Read the Received lines of message-disputed.eml from the bottom up. Which statement about the path is true?
- ☐ A. The first hop is mail.cedar-steel.example, so the supplier's own server sent the message.
- ☐ B. The lowest line records a client at 198.51.100.17 that reached mail-out.lookalike-mail.example. No line passes through the supplier's own server.
- ☐ C. The chain includes a DKIM signature that passed, so the path is authenticated from end to end.
- ☐ D. The top line was written by the sender's mail client.
Source (file, row): ________________________________
Q03 (2 pt) In cloud-export.csv, what is the UTC time of rec-000318, the record that shows the gateway received the message? Enter it as YYYY-MM-DD HH:MM:SS.
Answer: ____________________________________________
Source (file, row): ________________________________
Q04 (2 pt) The web view of the export shows the delivered_to_mailbox record rec-000319 at 09:20:07. What is its UTC time? Enter it as YYYY-MM-DD HH:MM:SS.
Answer: ____________________________________________
Source (file, row): ________________________________
Q05 (1 pt) How many seconds passed between the Date header of message-disputed.eml and the delivered_to_mailbox record rec-000319? Enter a whole number.
Answer: ____________________________________________
Source (file, row): ________________________________
Q06 (1 pt) Which domain did the receiving server's SPF check name in smtp.mailfrom for message-disputed.eml?
Answer: ____________________________________________
Source (file, row): ________________________________
Q07 (1 pt) Which address does the From header of message-disputed.eml show?
Answer: ____________________________________________
Source (file, row): ________________________________
Q08 (2 pt) What does the Authentication-Results line of message-disputed.eml record for DMARC, and what does that record not establish?
- ☐ A. dmarc=pass, so the sender is proven to be the supplier.
- ☐ B. dmarc=fail for header.from=cedar-steel.example, as recorded by mx.heron-yapi.example. It is the receiving server's recorded result, and by itself it does not show who wrote the message.
- ☐ C. dmarc=none, which means the domain has no policy.
- ☐ D. No DMARC result, because the header carries only the SPF result.
Source (file, row): ________________________________
Q09 (1 pt) How many Received lines does message-disputed.eml contain? Enter a whole number.
Answer: ____________________________________________
Source (file, row): ________________________________
Q10 (2 pt) If the accounts clerk pressed Reply, where would the headers of the message direct the reply?
- ☐ A. accounts@cedar-steel.example, the From address.
- ☐ B. accounts@cedar-steel-finance.example, the Reply-To address.
- ☐ C. lookalike-mail.example, the envelope sender.
- ☐ D. ap.clerk@heron-yapi.example, the To address.
Source (file, row): ________________________________
Q11 (2 pt) Which field is the strongest key for matching a record of the export to this e-mail?
- ☐ A. The Subject line, because the reader sees it.
- ☐ B. internet_message_id, matched to the Message-ID header, because RFC 5322 section 3.6.4 says a Message-ID holds a single unique identifier.
- ☐ C. The Date header, because the export uses the same times.
- ☐ D. The display name in the From header.
Source (file, row): ________________________________
Q12 (1 pt) Which client address does the export record for rec-000344, the internal forward from the clerk's mailbox?
Answer: ____________________________________________
Source (file, row): ________________________________
Q13 (2 pt) Is the export complete for its query window, 2026-03-12 00:00 to 2026-03-17 00:00 UTC (end exclusive)? Choose the statement that is true.
- ☐ A. Yes, for this query: six rows were returned, below the 500-row limit, and no next page is listed. The export shows nothing outside this mailbox, outside the window, or in message content.
- ☐ B. It cannot be judged, because the export does not state a row count.
- ☐ C. Yes, and it also contains the message bodies and attachments.
- ☐ D. No, because the window ends before the disputed message arrived.
Source (file, row): ________________________________

Finding paragraph

______________________________________________________________________