Email evidence
Email and Mailbox Forensic Investigation
Independent expert examination of message headers, routing, MIME structure, attachments, mailbox records and chronology where email evidence is disputed.
Direct access to Alistair Ewing · Free initial consultation · Written estimate before work
Go beyond the display name and printed page
An email shown in a screenshot or PDF may omit routing headers, attachment structure and mailbox context. Examination of the native message and related server or mailbox records can test whether technical features are consistent with the account given.
The analysis is framed around a specific proposition: for example, whether a message passed through particular systems, whether an attachment relationship is intact or whether the communication chronology conflicts with a document date. Findings distinguish observed facts from inference.
Questions email evidence may address
- Whether routing headers and authentication results are internally consistent.
- Whether the message structure, content and attachments are consistent across supplied copies.
- Whether mailbox, server or backup records place the message in a wider chronology.
- Whether forwarding, export, conversion or display software explains apparent differences.
- Which claims about sender, author, receipt or alteration go beyond the available technical support.
Most useful sources
- Native EML or MSG messages with full headers and attachments.
- Mailbox exports, server message trace or audit records where available.
- Copies from sender and recipient systems for controlled comparison.
- Related documents and the communication chronology.
- An account of how screenshots, PDFs or exported messages were produced.
Email header forensic analysis for litigation
If the dispute is whether a message was sent, altered or backdated, preserve the message in its original EML or MSG format where available. A forwarded message usually adds a new delivery history and may not retain all the original technical material. A screenshot or printed thread can still be useful, but it cannot replace every check available from the message and mailbox.
A focused examination can compare routing headers, message identifiers, authentication results, attachment structure and copies held by each party. Dates are assessed in the context of the systems that recorded them. The report explains which observations support the proposed history, any inconsistencies and what cannot be resolved. A header alone does not establish who typed or sent the message.
Where the concern is a fraudulent payment instruction or compromised mailbox, use the business email compromise and payment fraud service. That review also considers account access, mailbox rules and the payment chronology.
Limits of email and mailbox evidence
- A display name and visible From address are not proof of the human author.
- Headers can be incomplete, relayed, altered or lost during export and forwarding.
- Authentication results address particular domains and transmission checks, not every authorship question.
- Absence from one mailbox does not establish that a message never existed elsewhere.
What helps scope an email examination
- Party and entity names for a conflict check.
- The particular messages, dates and authenticity or provenance proposition.
- Available formats: native messages, mailbox export, screenshot, PDF or server records.
- Approximate number and size of messages and attachments.
- Jurisdiction, report deadline and funding basis.
Please do not attach evidence, passwords or confidential case papers to the public enquiry. A secure route is agreed only after the conflict check.
Frequently asked questions
Can a screenshot establish that an email is genuine?
A screenshot can record what was displayed, but usually omits the message structure, headers and source context needed for a fuller technical assessment.
Can an email analysis identify the person who typed it?
Technical records may support account, device or transmission findings, but human authorship often requires wider evidence and may remain qualified.
Read all questions about fees, timing, evidence and instructing Alistair
Initial enquiry
Need to test an email or mailbox chronology?
Describe the disputed messages, available native files or mailbox source, relevant accounts, date range and deadline. Do not forward confidential messages with the first enquiry.