Email Evidence: Reading Headers and Preserving Metadata
A printed email proves almost nothing. The headers behind it reveal where a message really came from and whether it was altered.
Email remains the backbone of commercial communication and, consequently, of commercial litigation. It is also trivially easy to fake. A printout of an email, the form in which most are still tendered, shows only what the sender wanted the recipient to see. Everything that establishes authenticity lives in the headers, and in the way the message is preserved.
The headers that matter
Every email carries a set of header fields added by the sending client and by each mail server the message passes through. Most are hidden by default. For an investigator, five of them carry most of the weight.
- Received: one line per server hop, added in reverse order, giving the IP address and timestamp at each stage. Together they map the message's actual route.
- Message-ID: a unique identifier assigned by the originating server, which can be matched against the sender's own mail logs.
- Return-Path: the address to which bounces are sent, often different from the visible From address in spoofed mail.
- DKIM-Signature: a cryptographic signature over selected headers and the body, which fails if either is modified after sending.
- Authentication-Results: the receiving server's verdict on SPF, DKIM and DMARC checks.
Spotting a spoofed or altered message
A message whose From address is a company domain but whose Received chain originates at a consumer webmail provider is a classic spoof. A DKIM signature that fails validation on a message the sender says is unaltered suggests editing after receipt. Timestamps that run backwards across hops usually indicate a misconfigured server, but occasionally a fabricated header.
Preserving email correctly
Export the source, not the rendering
Preserve the message in a format that keeps the full source: .eml from most clients, .msg from Outlook, or a mailbox export such as .mbox or .pst for larger sets. A PDF or a printout is a rendering, and renderings lose the headers entirely.
Hash each message and the container
Compute a SHA-256 for every exported message and for the archive that holds them. Record the mailbox, the account, the client version and the export date in the acquisition log.
Obtain the right certificate
The Section 65B certificate should come from the person who controls the mailbox or the mail server. For corporate email that is typically the IT administrator, who can also produce server logs that corroborate the Message-ID and delivery times. Where the mailbox is hosted by a service provider, a certificate from the provider may be required for the server-side records.
"Headers are the email's passport. They record every border it crossed and every stamp it received. Printouts simply leave the passport at home."
Email evidence that is preserved as source, hashed on export and certified by the right person is close to unassailable. Email evidence tendered as a printout invites every objection in the book. The difference is fifteen minutes of care at the point of collection.