I have the metadata (header) from a Tor sigaint.org email. I believe the sender did NOT use a VPN to access Tor. Is there something in the metadata that I should look for that can tell me who the sender might be?

Also, would any time-stamp identifiers in the metadata inform us as to WHEN the email was written (i.e. started writing at "$Created: 02/06/2017 12:44:37")

When the person "hit send" (i.e. finished writing and hit send "Received from atlas.mesvr.com(atlas.mesvr.com[]) by mx01.gwinnett.k12.ga.us with ESMTP id v161WhtX015961; Mon, 6 Feb 2017 13:32:44 -0500")

The time-stamp on the email says it "landed" in the recipient's in-box at 13:49 -0500

"Received from (helo=mx01.gwinnett.k12.ga.us) by lastline-sensor (ssl/tls); Mon, 06 Feb 2017 18:49:01 -0000"

The very top line says:

"Received: from lastline-sensor ([]) by SMTPGatewayS.gcps.kl2 (IBM Domino Release 9.0.1FP7) with SMTP id 2017020613490163-2260813 ; Mon, 6 Feb 2017 13:49:01 -0500 X_Lastline: benign"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.