Email and Electronic Correspondence Forensic Examination

A screenshot of a conversation is easy to alter, and its authenticity is open to challenge.

An email's authenticity can be technically assessed only by examining header data, the delivery path and server logs together. SPF, DKIM and DMARC are email authentication records used to verify the sending domain.

• Email header analysis and verification of the delivery path
• Technical assessment of sender identity and server logs
• Review of SPF, DKIM and DMARC authentication results
• Search for signs of spoofing and content tampering
• Search for deleted messages in the mailbox
• Examination of attachments and their metadata
• Assessment of conversations in messaging apps
• Building a communication timeline

We obtain correspondence from its source wherever possible, from the mail server or local mail files, using forensic methods. We do not treat a screenshot as sufficient on its own.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Acquisition and verification: the mailbox or mail files (PST, EML, etc.) are exported forensically and their hash values are recorded.
3. Analysis: headers, signature checks and server logs are compared to assess the authenticity of the message, and a communication timeline is built.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment.

Parties to commercial disputes, employment law matters, organisations running internal investigations and law firms.