The default option is that full headers appear at the BOTTOM of each received message.

Transcription

1 AOL The files are in an html format. The objective is to save the file in html format. This can be done as follows: - Open the message you want to save, as if you were reading it - Near the top, at the bottom of the To: / From: section, click on "Details" to reveal the header. (you could simply copy and paste this information also) - Move mouse cursor to the top tool bar, click on "File" - Move mouse cursor to "Save as..." and click. - Identify which directory you would like to save the file in. This is done using the normal save function of Windows. If you are not real comfortable with directories, save the file in "Desktop". This will have the file icon visible on you regular desktop screen and very easy to find later on. - Provide a name of the file in the "file name" box. - Select the "type" as "html" if possible. If your browser does not show "html" type, just select the type as "All Files" and add ".html" to the file name generated in step 6, such as .html. The "dot" before the html extension is important. The objective of this step is to have the extension of the file as an "html" type file. - Press "Save". To forward the file to someone else (law enforcement, lawyer, ISP): - Move cursor to the top tool bar and click on "Write" - Insert the address you want to forward the file to - Type any info in the body of the message, if needed - To add the html file you just generated in the above steps, click on "Attachments" - When the "Attachments Window" opens, click on "Attach" - Find the file in the directory window and highlight the file name. If you followed the "Desktop" instructions, the directory name is "c:\desktop". If there are too many files that appear, type "*.html" in the file name. The use of the asterisk (also called a star by some) lists all files that are html. - Click on "open" - Click on "OK" - Click on "Send now" - The message and attached file have now been sent. - Please be aware that AOL only keeps messages in your INBOX for two weeks, unless you save it as NEW or save it in a separate folder in your AOL directory on your computer. Additionally, a screen name of TOS 1 has been identified as a source of help for unacceptable in the AOL system. Just enter tos 1 in the "send to" screen. If you are outside of the AOL environment, the address is tos 1@aol.com. Compuserve Eudora Pro Excite Webmail The default option is that full headers appear at the BOTTOM of each received message. When reading an message, look at the toolbar just above the message itself. There should be a button that reads BLAH BLAH BLAH in black and white. Click on this and the full headers will appear. Then select all, copy and paste into a new message to send to the offender's ISP, or click on the forward button and the full headers will automatically be placed in the new message. - View the message - Use the "save to disk" option - Open the message's text file with your favorite text editor (notepad) - Copy the message from the text editor

2 Free Agent/Agent GMAIL: Click on MESSAGE, then "Show Full Headers." Go to the message, click inside the message pane, COPY, then PASTE to a text file or forward the message to yourself or to the appropriate ISP. Open an . On the right hand part of the you will see a small down arrow. Click that arrow and a drop down box will appear like this: Click on the Show Original button in the drop down box and a new window will open with the headers in that new window. Copy and paste all the headers into a new . Hotmail Hotmail Old - Go to Options - Go to Preferences - Scroll down to Headers, then click on Advanced Headers 1) Look in upper right side of screen, find link OPTIONS, click on that. 2) Find link Mail Display Settings click on that link. 3) Find Message Headers section and click on Advanced. The screen will look like this:

3 Hotmail s Live Mail (new version) Click OK at the bottom to save your changes and then go back to the message you want traced and you will see all the headers needed to trace it. Copy/paste all of the headers and message into another . Once that is done, you can forward the original message AS AN ATTACHMENT to another as well, that way I ve got each it two formats. In the message list pane (top pane) highlight a message and then right click on that highlighted portion. Scroll down to View Source and click View Source. A new window will open with the full message headers in it. Copy all contents of this window. Return to Hotmail and click on

4 FORWARD to forward the original message. Paste the contents of the Header window at the top of the message text portion of the forwarded message so that we have the full headers at the top of any text. If the default setting is to forward as an attachment, then simply paste the full headers text into the text box that will be sent to us with the attached original . Alternatively, you can open the message and then look for the tiny down arrow to the far right of the message, as pictured here: Click on that down arrow will produce the drop down box viewed here. Look towards the bottom and you will see View Message Source. Click that and the same header box as in the method above will appear and you may then copy and paste those headers into a new message for your investigator to trace. imail (MAC) Open your client and select View and then Message. Select Long Headers Cut and pastel the entire contents of the window that displays. IN.com Open a message. On the right of the screen you will see a drop down menu/arrow that is titled more details.

5 Click on more details and now you will see a link titled Show Headers. Click this link. A new window will open with your message headers in this window. Now you can copy/paste those headers where you wish. INBOX.com accounts: Open a message and look to the far right of the screen. You will see a link to show details. Click this link and you will now see the following: Now click the link that says, show raw source (in new window). A new box will open and you will see the following:

6 You can now copy and paste this information where needed. Juno Version 4+ On the drop down menu "Options", choose " Options.." (press ctrl-e) Under "Show Message Headers", select the "full" option. Click the OK button to save the setting. Juno version 4+ can display MIME and HTML , but does not provide a way of Viewing the HTML Source for the message within Juno. To get the full source, including HTML codes: - In the Juno mail client, click "file" and then "Save Message as Text File.." (ctrl-t). - Give the file a name which you will remember (many people save temporary files to the desktop). - Double-click on the resulting file. Lotus Notes 4.6 (Win 9x client) Lotus Notes - Open the properties box on the message (in the default installation of the Notes Client, it will be the first smart icon on the left, but you can also right-click on the document and choose properties from that menu) - Choose the second tab on the properties box, which is a list of fields and their contents - Scroll down to the field "$additionalheaders." - Select the contents of the field and hit Ctrl+C to copy them to your clipboard - Open a new message, put your cursor in the body of the message, and hit Ctrl+V to paste the headers there - If Notes will not permit you to select the contents of the field, you'll have to manually copy them to a new message - please be very careful in doing so. - Open the . Then go up to the tool bar and click VIEW, scroll to

7 8.5 SHOW and then PAGE SOURCE. - In the old version it was under View > Show > Message source. It is now under View > Show > Page Source. "Page Source" is only available for SMTP (incoming "Internet") . It is not available from one Notes user to another or for system generated s like Delivery Failure Notifications. You will also need to make sure that View -> Advanced Menus is checked. Exchange Internet Explorer Internet News Outlook 98, Outlook 2000, Outlook 2003 Outlook 2007 Outlook 2010 Open the message in Exchange to view it. Choose "File," then "Properties," then "Internet." The header will be visible and will be highlighted. Simply right click and copy it. Then paste on the front of the message and forward it. - Choose "Properties" under "File". Click on the "Details" tab. This will show the full header. - Now right click and choose "Select All". Right click again and choose "Copy". Start a new message, right click again, and choose "Paste". This will paste the entire header into this new (and temporary) message. Copy the header from the new message and paste it back onto the original. The paste command doesn't work directly on the original message. This isn't elegant, but it seems to work. For those people who use 's Internet News, simply (while viewing the message) click on File, Properties, then click on the Details tab. Sending complaints to root@someisp.com will also work. Some other addresses are support@, webmaster@, and newsmaster@ Open the message and select View, then Options from the drop-down menus. Near the bottom of the screen you'll see a section titled INTERNET HEADERS. You can copy the headers and paste them into an elsewhere to get them to the proper people. Double click on the message so that it is open in its own window. Outlook 2007 and 2010 uses a watered-down version of Word as the editor and with it comes the new ribbon user interface. Thus, the "Options" feature is no longer under "View", as with previous versions of Outlook, and takes some hunting to find it, but it is there. It is on the "Message" tab, in the "Options" block, which is the fourth block over. To the right of "Options", there is a little button with an arrow in it. Click on it and you have the message options menu with the internet headers in the bottom section. Select this information and copy/paste it as needed. Outlook 2010 is a bit complicated. The easiest way is to bring back the view source icon to the ribbon. First you need to right click on in the ribbon and choose Customize the Ribbon. In order to add a new button to the ribbon, a new group needs to be created. It is probably best to expand the Home (Mail) Tab, select the last option which was Find in my case and then click the New Group button. Rename the Group and ensure it is selected. Then select All Commands under Choose commands from:, scroll down and select Message Options and then click Add.

8 Click Ok back to outlook and you will now be able to select an , click on the new button in the menu and view the headers. Outlook Express 5 There's an even easier solution to expanding 's Outlook Express 5 headers so that you can copy and paste it to another window: - Right click on the message and select Properties. - Choose the Details tab and select the Message Source Button. - Select All (CTRL + A) and Copy (CTRL + C). - Close the Message Source window and the Properties window. - Select New Mail and position your cursor in the body of the . - Paste (CTRL + V) the copied information. Send the to the analyst. Additional Method Here's a tip to simplify the process of getting full headers when using Outlook Express 5 and Windows 98 (don't know about other versions of OE) - Instead of selecting the message, right-clicking properties, clicking details, then message source, simply select the message and press Ctrl-F3. Then press Ctrl-A followed by Ctrl-C. (Ctrl-F3 takes care of all the steps necessary to get to the full header. Ctrl-A selects all the text and Ctrl-C copies it to the clipboard.) Now start a new message or just forward the original message (which takes less time than opening a new one) to the originating ISP. Windows Mail In Vista, Windows Mail replaced Outlook Express. 1. In the list of messages, right-click the message you want to forward and

9 for Vista Mozilla Thunderbird Netscape Messenger Netscape News Newswatcher Operamail Pegasus Pine Unix select Properties. 2. In the Properties window, select the Details tab. 3. Right-click anywhere in the "Internet headers" field and click Select All or simply hit Ctrl and A at the same time. 4. Right-click again and click Copy or Ctrl +C 5. Close the Properties window. 6. With the that you want to forward still selected, click the Forward button. 7. Paste the copied information at the beginning of the message. Hit Paste or Ctrl + V. To read the headers in the Mozilla Thunderbird client, simply open the . On the menu bar, go to View Headers and select "All". The headers are immediately displayed. To read the header in Netscape Messenger (the reader supplied with Netscape communicator) press Ctrl-U. A new window will open with the full message including the complete header. To copy this to a message press Ctrl-A to highlight the entire message then Ctrl-C to copy it. Open the message you want to send. Using the mouse, place the cursor in the body of the message, select edit / paste as quoted, from the menu bar. Simply click View-> document source when you're looking at the offending item. The full headers are then visible. If you want the full headers on Newswatcher, go to File, choose Preferences, and check the Show Article Headers box. Choose Options and enable [x] Show Message Headers in Body of Message In Pegasus, just hit Ctrl-H (or the backspace key) while reading a message. You will see the full headers. Do this *before* hitting "F" (for Forward), and the full headers will be forwarded, too. You must configure Pine to allow showing message headers. You may skip steps 1-3 below if you have performed this configuration. >From the main Pine menu, type S for Setup, then C for Config. Use the space bar and down arrow to scroll until you reach the option [ ] enablefullheader-cmd, then type X in the box to toggle the option on. Type E to exit Config, and Y to save changes. The next time you read a message, type H and the full headers will be displayed at the top of the message. Type H again to hide the headers. I think I've figured out one way of of getting the full headers on Unix. We received a spam and the message had just the usual "from," "to," "date," "subject" headers. But when I saved the message in a directory, then used the "type" command or printed it out, full headers magically appeared, showing where they were really posting from. Another Tip: Some more header info for some Unix mail programs. Nearly nobody uses mail and mailx any more, but they're available on almost all UNIX systems, so let's start with those. You can exit your current mail program without changing the mailbox and then look at the mail message using mail or mailx.

10 Showing a mail message with the Print or P command displays all of the header lines. Note capital P -- it's important. Saving the current mail message with the saveretain command saves all of the header lines. (On some systems, Save or S -- note the capitals! -- does this too). There are lots of other mail readers; the one I use is ELM. In ELM, you display the headers for the current message with the H command. WebTV Yahoo Classic: While viewing the , hit "Forward" on the sidebar. Address the document to yourself. Completely erase the subject line. Put your cursor on the first line of the "body" (text area); Hit "Return" (enter) twice. Your cursor should now be on the 3rd line of the text area. Type any "Alt" character on this line; DO NOT HIT "RETURN" Cut and Paste the "Alt" character onto the subject line: (CMD+"A"), (CMD+"X"), (CMD +"V") The "Alt" character should "jump" down to the message text-area. Hit "Send"; open the received mail. 1) In the upper right hand section of your Yahoo , once you log in, you'll see the link to OPTIONS. Click OPTIONS. 2) Now you'll see a screen that has options on it. Select the link to GENERAL PREFERENCES, Click that. 3) Scroll down to the MESSAGES section and you'll see a sub-heading of HEADERS. 4) It will look like this: Yahoo New Mail Make sure the button next to Show ALL headers on incoming messages, is clicked. Save your changes at the bottom of the page and then go back to the inbox message and all headers will now be visible. Highlight all of that, the entire page with your cursor, copy and paste it into another . When you open your Yahoo account, by default you see a view that has two panes, an upper and a lower pane, as seen below:

11 In order to view the full headers from within Yahoo, make sure the upper pane has the target message highlighted, as in the image above and then right click on that highlighted portion with your mouse. You will see the following menu appear as a pop up: Now, look down the menu until you see the View Full Headers command, which you can see below: Click on that command and the following box will appear:

12 Now all you have to do is put your cursor into the box, select and copy all that coding into a new and send that to the investigator you ve hired to trace the . Please send the original as well, under separate cover, because there are sometimes clues in the itself.