FTP, IMAP & POP3
FTP
File transfer protocol (FTP) is a common standard for the exchange of data files between computers using Transmission Control Protocol/Internet Protocol (TCP/IP). An FTP site or server can be hosted on a local client or in the cloud.
There are two types of FTP communication that MOBILedit Cloud Forensic can access, FTP which is unencrypted and FTPS which is encrypted using SSL.
FTP can be used for storing many files and large amounts of data for use on websites, for remote access to corporate files, or even by private users that have set up network-attached storage (NAS) devices on their home network so that they can access their files remotely.
To connect to FTP, you need to first enter the “Host” detail which is in the following format:
ftp://hostnameoraddress:port
or
ftps://hostnameoraddress:port
Then enter the “Username” and the password in the relevant fields. Once connected, you can choose the required options for filtering, reporting and exporting formats and settings.
The length of time it takes to download will depend on the number of files and their size.
If the FTP communication type is missing, then a default of FTP is used.
If no port is entered in the “Host” field, then the default port will automatically bet set as port 21 for FTP and port 990 for FTPS.
So it is possible to have a double default, whereby the protocol defaults to FTP and to port 21 if only the address is entered.
We advise users to consider using filters when downloading data using FTP as there could be many files.
IMAP
Internet Mail Access Protocol (IMAP), is a standard protocol used by most email servers for sending and receiving emails and keeping everything synchronised across multiple devices. It is a two-way flow of data between the email server and user clients and can be set up and used on many devices at once. IMAP is more flexible than POP3 and one of the main differences is that IMAP allows for emails to remain on the server after a client has downloaded them.
To connect to an email account using the IMAP protocol, you will need to identify the correct settings for the server name and the port. These are normally made available online by the email service provider.
The server name for Outlook is outlook.office365.com and for Google it is imap.gmail.com, both Outlook and Google use SSL encryption for connection via Port 993.
Enter the server name and port number in the “Host” field in the following format:
Servername:port
As an example, a secure or encrypted Google “Host” entry would look like this:
imap.gmail.com:993
Then enter the email address as the “Username” and the password in the relevant fields. Once connected, you can choose the required options for filtering, reporting and exporting formats and settings.
The length of time it takes to download will depend on the number of emails and attachments, and also the size of any attachments.
If only the server name is entered in the “Host” field, then the default port will automatically be set using port 993.
We advise users to consider using filters when downloading data using IMAP as there could be many hundreds or thousands of emails.
POP3
Post Office Protocol 3 (POP3), is a standard protocol used by most email servers for receiving emails and downloading them to a local client using TCP. It is a one-way flow of data upon request by the user client and usually, emails are removed from the server after being downloaded. This depends on the service provider as to what settings options are available and those that have been selected by the user.
Before the acquisition, it is likely that the investigator won’t know if the emails will be deleted from the server or not. Therefore, it should be assumed that they will be deleted unless the account settings are known. Accessing POP3 accounts using Forensic Cloud is done so at the investigator's own risk, and the fact that emails could be deleted should be recorded in notes.
To connect to an email account using the POP3 protocol, you will need to identify the correct settings for the server name and the port. These are normally made available online by the email service provider.
The server name for Outlook is outlook.office365.com and for Google, it is pop.gmail.com, both Outlook and Google use encryption for connection.
Enter the server name and port number in the “Host” field in the following format:
Servername:port
As an example, a secure or encrypted Google “Host” entry would look like this:
Then enter the Username, which is the email address, and the password in the relevant fields. Once connected, you can choose the required options for filtering, reporting, and export formats and settings.
The length of time it takes to download will depend on the number of emails and attachments, and also the size of any attachments.
If only the server name is entered in the “Host” field, then the default port of 110 will automatically be used.
We advise users to consider using filters when downloading data using POP3 as there could be many hundreds or thousands of emails.
“Starting in Autumn/Fall of 2024, less secure apps, third-party apps, or devices that have you sign in with only your username and password will no longer be supported for Google Workspace accounts.” Read more on google.com
This means that MOBILedit Cloud Forensic will no longer be able to access Gmail email accounts using POP3 or IMAP, after Google’s withdrawal of support for these sign-in methods.