Locating suspect emails continues to be a task that incident response analysts often engage in. This can include externally caused incidents such as social engineering, where analysts may be tasked with locating a suspect email that had malware attached. In other circumstances, malicious insiders may have sent or received communication that was inappropriate or violated company policy. In those cases, analysts may be tasked with recovering those emails to include in termination proceedings or in legal action.

Autopsy has the ability to locate emails contained on the system. From these emails, they may be able to identify one or more suspicious emails and domains that can be further researched to see if they are associated with social engineering or other malicious activity. Simply click on the Email Addresses in the left-hand pane. From there, the analyst can see the email addresses that are located on the system: