Email Conversations Reconstruction Based on Messages Threading for Multi-person

The email conversations reconstruction and analysis is a key task of the digital forensic, however, most forensic tools only parse email data without analysis. This paper presents a novel thread-based conversations reconstruction mechanism that provides an effective analysis and statistics of the email flows for multi-person. The mechanism includes a data extraction rule for email headers extraction and redundant emails filtering, a messages mapping algorithm to keep the messages without message-ID in correct parent/child relationship, and a topic-based heuristic to merge or decompose threads to conversations. The experiment results show that our mechanism exhibits high performance on conversation detection, tracking and parent/child relationship keeping, which suggest that the mechanism is a feasible strategy for email conversations reconstruction in digital forensic.