Role of Outlook Express DBX Files In DBX Forensics
Like other desktop email applications, even Outlook Express has been observed to be used a lot in malicious web based activities. Thus, Outlook Express DBX file forensics is also an essential part of email client data forensics. And as Outlook Express is no longer in use as support was stopped by Microsoft, a lot of challenges are usually confronted by investigators, especially opening and accessing the file for DBX forensics. Moreover, when the file is multiple in numbers the process becomes more tiresome and next to impossible, because each folder has a DBX file each of its own and Outlook Express only works with XP.
DBX File Information - A Detailed Overview
The DBX file extension files are a collection of emails thus; they are more of an email folder than file. The client, Outlook Express uses the common extension for saving the emails of all its folders. All the folders of a user account created on the client are saved at its default store folder location with .dbx extension. Thus, each folder is represented as; inbox.dbx, deleted items.dbx, drafts.dbx, sent items.dbx, and the same applies to custom folders, if any.
The DBX file structure in a raw format shows a basic hexadecimal arrangement. Header portion also known as file signature can be seen beginning with the hex value:
CLSID, i.e. Content Class ID is an identifier that distinguishes the DBX file type. This is usually a string at the start of the file that defines respective file on the OS.
Outlook Express DBX File Format Forensics
Closely observing the structure of DBX files shows that on deleting any message, a trace is left behind. When a message deletion takes place, in the header block, 0x0200/ 0x01fc and the DBL (Data Block Length) gets updated reflecting a deletion. Moreover, in the data block the first 4 bytes get overwritten. This way, in case of evidence tampering, during the process of Outlook Express DBX forensic it can be detected during the DBX file forensics by studying the structure keenly.
Present Time DBX Forensics Challenges
The major challenge commonly faced during DBX forensics is that Outlook Express has now become outdated. Only a rare count of users presently have Windows XP, which is the only version of the platform that supports usage of Outlook Express, in fact, comes preinstalled with one. Therefore, since the end of support for both; the OS version and OE client, primary challenge of investigating DBX files turned out to be its orphaned state.
Moreover, the detailed header analysis during Outlook Express DBX forensic became more of a challenge as far as complete internet header information was concerned that couldn't be viewed without the application.
