Is it possible to know the physical location of the computer that was used to write an email and how would you access that information?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
BTW if you have the IP address of the sender you can try the whois option to get information on the address.
Another resource is:
http://www.dnsstuff.com/
As trywaredk has pointed out it is possible for someone to falsify the reply address and also other header information.
If the email has been sent by someone determined to hide their identity (say a spammer) you wont have much luck tracking them down.
If, however, the email was sent by a standard user using a basic/standard email setup then it is poossible to determine the location using the tools above (whois and reverse whois should be most helpful)
gidds99,
So if I type in the IP address it will give me the physical location on the computer? Or is the address that it pulls up the servers address. There's was several IP addresses the other one was yahoo and gave me yahoo's address and phone number. The other one showed and address, do you think that's the one? Thanks for your help.
The header may look something like this:
X-Message-Info: JGTYoYF78jEHjJx36Oi8+Q1OJD
Received: from SWEEP1.uk.abcdefghijklm.co
Tue, 8 Jul 2003 05:27:56 -0700
Received: from snserv.dom (unverified) by SWEEP1.uk.abcdefghijklm.co
(Content Technologies SMTPRS 4.3.6) with ESMTP id
<T634e7d9d3ec0a8cb12780@SW
+0100
Received: from DTxxxx ([128.5.x.x]) by snserv.dom (8.10.2+Sun/8.10.2)
In this header the originating IP address is on the last line (128.5.x.x) - I have changed the actual IP's and domain names in this example as not to expose the actual systems concerned - so to find who sent this you would perform a reverse DNS lookup on 128.5.x.x to investigate further and confirm the ID of the sender. You can also see that the path of the email is shown, you can see it being received by the server from the client and then it is passed through several mail servers/relays. Also worth condisering is that if the IP of the originating client is a dynamic one (assigned by an ISP to a dial up customer for example), the best you may be able to do is identify the ISP concerned as the IP would be re-assigned to multiple customers.
You have to consider (as pointed out above) that email headers are often spoofed (falsified) to conceal the senders true identity (this is especially true of spam) and that sometimes you may only get the address of a open mail relay or a proxy.
This article may be of some assistance to you (its not specific to email but gives general pointers on investigating specific hosts):
http://neworder.box.sk/new
If it was a Yahoo email address the mail came from you have a decent chance (assuming the header is real and not spoofed) of identifying the Host (or maybe just the proxy) of the sender.
You can post the header (less any specific hosts/IP's) and I can try and point you in the right direction.
Here is another couple of links which discuss tracing email in detail:
http://www.visualware.com/
http://www.usus.org/elemen
Hope these help.
Business Accounts
Answer for Membership
by: gidds99Posted on 2005-02-15 at 00:19:55ID: 13311642
You can look at the header of the email which will show the Hostname / IP address of the sender (let me know if you need help on how to view the header - include which email client you use).
Once you have the hostname or IP of the sender you can use these tools to try and determine the location of the sender:
http://www.infosyssec.com/
However, if the sender has wished to conceal their identity it would be easy enough for them to use a proxy or an open mail relay to hide their true location.
Hope this helps.