I have the metadata (header) from a Tor sigaint.org email. I believe the sender did NOT use a VPN to access Tor. Is there something in the metadata that I should look for that can tell me who the sender might be?
Also, would any time-stamp identifiers in the metadata inform us as to WHEN the email was written (i.e. started writing at "$Created: 02/06/2017 12:44:37")
When the person "hit send" (i.e. finished writing and hit send "Received from atlas.mesvr.com(atlas.mesvr.com[22.214.171.124]) by mx01.gwinnett.k12.ga.us with ESMTP id v161WhtX015961; Mon, 6 Feb 2017 13:32:44 -0500")
The time-stamp on the email says it "landed" in the recipient's in-box at 13:49 -0500
"Received from 10.242.255.17 (helo=mx01.gwinnett.k12.ga.us) by lastline-sensor (ssl/tls); Mon, 06 Feb 2017 18:49:01 -0000"
The very top line says:
"Received: from lastline-sensor ([10.241.5.10]) by SMTPGatewayS.gcps.kl2 (IBM Domino Release 9.0.1FP7) with SMTP id 2017020613490163-2260813 ; Mon, 6 Feb 2017 13:49:01 -0500 X_Lastline: benign"