🔍 Digital Forensics Case Study: Email, Metadata & Timeline Correlation Analysis (Anonymous Project)

Recently I completed a deepdigital forensics and data-correlation investigationinvolving a large dataset of emails, file metadata, CRM exports, and PST archives. Due to confidentiality and legal sensitivity, I cannot share real names, companies, or actual data — but I want to share thetechnical approach, methodology, and lessons learnedfrom this project.

This case required combining multiple forensic sources into one consolidated analysis to identify inconsistencies, automation patterns, and timeline anomalies.

🧩 Scope of the Investigation

The project involved forensic analysis of:

• Email PST archives (thousands of messages)
• Autopsy extraction reports
• File metadata & EXIF data
• CRM exports (leads, deals, payouts, assignments)
• Document attachments (PDF, images, spreadsheets)
• Timestamp correlation across systems
• User activity logs & call logs

The goal was to determine:

• Whether records were created in real time
• Whether documents were reused or backfilled
• Whether multiple users were operating under one account
• Whether timeline events matched across systems

⚙️ Methodology Used

1. Email Forensic Analysis

• Parsed headers, subject lines, bodies, and attachments
• Checked repeated subjects and batch patterns
• Compared send/receive timestamps
• Identified automated vs manual email behavior

2. Metadata & Document Forensics

• Extracted PDF author / owner metadata
• Checked file creation vs modification times
• Identified template reuse patterns
• Verified scanner / device / software tags

3. EXIF & Image Analysis

• Checked device models
• Verified capture timestamps
• Looked for GPS / location mismatches
• Grouped files by hardware fingerprint

4. Timeline Correlation

Compared across:

• Email time
• File creation time
• CRM record time
• Funding / approval time
• User login time

This revealed cases where:

• Documents appeared after deals were completed
• Files were created in batches
• Emails did not match CRM events

5. Personnel & Access Pattern Analysis

• Checked overlap between users
• Found near-identical deal assignments
• Detected possible shared accounts / delegation
• Identified workflow anomalies

6. Excel + Autopsy + Custom Scripts

Used combination of:

• Autopsy forensic output
• Excel pivot tables & formulas
• CSV / XML exports
• Python scripts
• Manual validation

This allowed building afull forensic timeline model.

📊 Key Lessons from This Investigation

✔ Data from different systems rarely matches perfectly

✔ Metadata often reveals more than visible data

✔ Batch timestamps are strong forensic indicators

✔ Shared accounts leave detectable patterns

✔ Pivot tables are extremely powerful in forensic work

✔ Autopsy exports can be correlated with CRM data

✔ Timeline comparison is the most important step

🛠 Skills Used in This Project

• Digital Forensics
• Email PST Analysis
• Autopsy Forensic Tool
• Metadata / EXIF Analysis
• Excel Advanced Analysis
• Data Correlation
• Timeline Reconstruction
• Fraud / anomaly detection
• Python data scripts
• CRM data analysis

🔐 Note on Confidentiality

This post intentionally avoids:

❌ Client names ❌ Company names ❌ Real data ❌ Screenshots ❌ Case details

The purpose is only to sharetechnical experience, not the case itself.

🚀 If you need similar work

I work on:

• Digital forensics
• Email analysis
• PST / Autopsy analysis
• Data anomaly detection
• CRM / log correlation
• Investigation support
• Expert technical reports

Available for consulting & forensic projects.

Originally published on a2cybertech.blogspot.com.