Can identify that an idevice was used in email headers?

[patent10021]

Can the desktop OSX mail headers show that a device and not PC was used?

Or can I only compare IPs to determine that it's the same device or PC I've been contacted with previously etc.

 

[emir]

I am not being a 100% sure but I don't think there are ways to tell which device the mail was sent from, unless the sender ended the mail with a sort of "Sent from my iPhone" thing.

p.s. Remember when "Sent from my iPhone" signatures on e-mails were thought of as being rude? haha.

 

[Weaselboy]

Can the desktop OSX mail headers show that a device and not PC was used?

Or can I only compare IPs to determine that it's the same device or PC I've been contacted with previously etc.

X-Mailer: Microsoft Outlook Express 6.00.2900.5931

Look at this header to see what client was used and that should give you a clue what device was used.

 

[patent10021]

X-Mailer: Microsoft Outlook Express 6.00.2900.5931

Look at this header to see what client was used and that should give you a clue what device was used.

That's the obvious but I'm looking at a gmail header that seems to be encrypted.

Received: by 10.112.199.66 with SMTP id ji2csp5342lbc; Wed, 26 Mar 2014 18:49:36 -0700 (PDT)
Received: by 10.58.137.229 with HTTP; Wed, 26 Mar 2014 18:49:35 -0700 (PDT)
Return-Path: <xxx@gmail.com>
Received-Spf: pass (google.com: domain of xxx@gmail.com designates 10.58.154.10 as permitted sender) client-ip=10.58.154.10
Authentication-Results: mr.google.com; spf=pass (google.com: domain of xxx@gmail.com designates 10.58.154.10 as permitted sender) smtp.mail=xxx@gmail.com; dkim=pass header.i=@gmail.com
X-Received: from mr.google.com ([10.58.154.10]) by 10.58.154.10 with SMTP id vk10mr63162607veb.18.1395884975137 (num_hops = 1); Wed, 26 Mar 2014 18:49:35 -0700 (PDT)
X-Received: by 10.58.154.10 with SMTP id vk10mr63162607veb.18.1395884975133; Wed, 26 Mar 2014 18:49:35 -0700 (PDT)
Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=FhWiCIrYJedqYkjfS+o+5XdQRuaao0xv4WnrANI5Q4k=; b=z9budi0lhhvct5wVlGsV51OqizTbV5sSj0qPehEsFXU0LkGZKKp64JlQ8NGLPSYchS mfreY7SK2baxbIFtz8zB7DdTXDMePkhDHCBhlO62C+AVA5mu48ZRu5j0kUF/N74YlHzl vj7CK72GvvOo/eq9U0mD67R+8wl2+fesIqRvnjYYLH0iTbXj8D9BbKXM0n57MPl+pbLh ZYrKhykGQhO+cxfQbCuLWvYgQtw3+NVbHMGR5Bn1zvU+83N4F25uLg9+gVXLditsd8hP /sg32IbGbttPCVKHYnqMoF7/D1Hvyp88KKZXc8K9wM1VwDW86YIBLUOHyuWo7Uw5962h /Bjg==
Mime-Version: 1.0
In-Reply-To: <CAKJZnhzGQimCj9DCWLcxnYG38D+KNtq6ihDwiiYrEv0=do4URQ@mail.gmail.com>
References: <B0C8C63A-A2B1-4C8D-86CB-BBF0F6DBCFA2@gmail.com> <CAKJZnhzGQimCj9DCWLcxnYG38D+KNtq6ihDwiiYrEv0=do4URQ@mail.gmail.com>
Message-Id: <CAKJZnhw-+DzWyv1A72RwhFVzJ4ZXX17Ree19g0SGsj4zo37NQQ@mail.gmail.com>
Content-Type: multipart/alternative; boundary=047d7b5d84ef17194804f58ccc0a
Re:

But...iDevice IPs usually look like 10.xx.xxx.xx right? A normal IP from any country would always start with some larger number like 174, 139 etc.

 

[ElectronGuru]

There are few standards for email header lines, often it's what a given link in the chain volunteers to add as it passes by. If there isn't an x mailer line, you likely won't find it.

But how you view the headers is also important. Web viewers are stingy or confusing, best to use a real mail app first.

 

[Weaselboy]

But...iDevice IPs usually look like 10.xx.xxx.xx right? A normal IP from any country would always start with some larger number like 174, 139 etc.

It is not necessarily an iOS device at 10.xx, but just a locally assigned IP address. Your "real" IP address would be 174.xx like you said, then that goes to a local router that hands out those 10.xx series addresses to any device in the house.

 

[Dark Dragoon]

But...iDevice IPs usually look like 10.xx.xxx.xx right?

No.

The private IP address ranges which can be used on internal networks are:-
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255

If you are looking at an IP address in one of those ranges then it is simply an IP address from an internal network.
These addresses can be used by anything and because they are private ranges are not unique.

A normal IP from any country would always start with some larger number like 174, 139 etc.

No.

Normal IP address can be almost (there are some other ranges which aren't used, and some special ones like 127.0.0.1) any other address, there isn't really any reason that you wouldn't see someone using an address starting with a low number. You can see who owns what at: http://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_address_blocks


But regardless an IP address on its own will not tell you what device or kind or device was used to send an email.

 

[patent10021]

ok so we have determined that there is no way to tell if someone is using a desktop or iOS device in the headers. Too bad.

Thanks