Has this email been altered?
Assess native messages, attachments and corroborating records.
Explore the assessment →Email evidence · Hong Kong & cross-border matters
Clarity in the
email evidence.
When a message is disputed, the details matter. Examine what was sent, what survives and what the evidence can support.
For lawyers, organisations and individuals with substantive evidential questions.
Beyond the visible messageEML / 001
One email. Several questions.
- From
- accounts@example.com
- To
- recipient@example.org
- Subject
- Re: Revised payment instructions
- 01Content & structureWhat do the message and attachments contain?
- 02Transmission & provenanceWhich independent records support the account?
- 03Meaning & limitationsWhat follows from the evidence, and what does not?
Fictional illustration. No client material.
Start with your perspective
The question comes first
What do you need to establish?
The right examination starts with a defined question, the available sources and the limits of each.
What should we preserve?
Identify the sources and document an authorised collection.
Explore the assessment →Can missing email be found?
Assess deletion history, surviving copies, archives and backups.
Explore the assessment →Were payment instructions changed?
Examine an email chain alongside available account activity.
Explore the assessment →Why do these mailboxes differ?
Compare message sets, reconcile gaps and build a chronology.
Explore the assessment →What can be reported for proceedings?
Agree technical findings, evidence schedules and expert reporting.
Explore the assessment →Platforms & sources
The account is only part of the picture.
Messages may survive in a service, a local mail store, an archive or another correspondent’s records. Each route has different prerequisites.
Platform information describes potential sources. Availability and D3’s examination route require assessment.
Browse all platformsMicrosoft 365 & ExchangeManaged tenants, servers and hybrid environmentsOutlook & local dataClient versions, PST, OST and message filesGoogle Workspace & GmailBusiness and personal accounts, assessed separatelyLinux & self-hosted mailTransport services, mailbox stores and logsApple Mail & iCloudThe provider, the client and locally retained copies
A proportionate process
From the question to a supported finding.
01
Define the issue
Identify the disputed proposition, available sources, authority and deadlines.
02
Assess & preserve
Agree feasible collection routes and record the material obtained.
03
Examine & compare
Test relevant explanations against the evidence and independent records.
04
Report the findings
Separate observations, interpretation and limitations in the agreed deliverable.
Evidence, with its limits
A clear answer includes what cannot be established.
Feasibility depends on the service, settings, history, access and condition of the material.
Explore the evidence source matrix →- A matching hash supports byte consistency. It does not identify the author.
- Domain authentication does not, by itself, prove who wrote a message.
- A missing search result does not prove that a communication never existed.
- Preservation now cannot be assumed to recreate previously purged data.
Understand the evidence
Practical guidance. Precise distinctions.
Email evidence guide
Native email or screenshots: what is the difference?
A screenshot records an appearance. A native message can retain structure that helps explain how the message was represented, routed and stored. Both may be useful, but they answer different questions.
Read the guide →Email evidence guide
What email headers can tell you
Headers can help explain addressing, routing and message handling. Interpretation depends on which system created each field and whether that part of the record can be trusted.
Read the guide →Email evidence guide
SPF, DKIM and DMARC: useful signals, limited conclusions
These mechanisms help assess use of email domains. A passing result does not establish the human author or the truth of a payment instruction.
Read the guide →