Setting up a sandbox for Emails

This note exists because I received a rather suspicious email with an attachment from a well known sender!

Requirements

• Setup a blackbox VM
• Setup a throwaway email (ProtonMail if the email content is sensitive or a temp email service like Temp-mail)

Workflow

1. Run your VM
   1. If your Virtualization tool has a “Run without saving changes” option use that to start the VM
   2. If not, snapshot the VM at it’s clean state, then start the VM normally
2. Open your proton or temp email in the VM in a private browsing session
3. Download the attachment
4. Close your private browsing session
5. Open and do what you want with the attachment
6. Shut down the VM
7. If you had taken a snapshot in step 1, restore the VM to that snapshot