Which source could help?

Potential content

Message body, transport headers, MIME structure and embedded attachments from a supplied native representation.

Acquisition prerequisites

Authorised access to the message or a preserved native file; record the client and export method.

Retention & configuration

The source must still exist. Forwarding, saving and conversion may change fields or omit content.

Evidential limits

A native file can be edited. Structure and domain authentication are not conclusive evidence of human authorship or truth.

D3 capability: requires confirmation. Related guidance →
Sources: IETF: Internet Message Format · IETF: DKIM signatures

Potential content

Messages and selected metadata within the account, folders, query and format actually collected.

Acquisition prerequisites

Appropriate account or administrator permissions; documented scope, filters, export settings, errors and exclusions.

Retention & configuration

Service, licence, hold and retention configuration; deleted material may already have been purged.

Evidential limits

An export is not automatically a full forensic image or a complete account history. Attachments that are links may require separate collection.

D3 capability: requires confirmation. Related guidance →
Sources: Microsoft: Exchange retention · Google: Vault retention

Potential content

Locally held email and client artefacts, potentially including PST, OST, mbox or Maildir data.

Acquisition prerequisites

A preserved store or authorised device access; identify the actual client, version, account and any keys.

Retention & configuration

Synchronisation settings, cached period, local-only folders, encryption, deletion, compaction and subsequent use.

Evidential limits

A cache can contain only part of a mailbox. Its absence does not establish absence from the service or another device.

D3 capability: requires confirmation. Related guidance →
Sources: NIST: digital evidence preservation

Potential content

Recorded account or mailbox operations, identities and times within the available audit scope.

Acquisition prerequisites

Authorised administrative role and access to the relevant audit service; preserve the query and export context.

Retention & configuration

Service and audit configuration, licensing, operation coverage and log retention. Mail retention does not establish audit retention.

Evidential limits

A recorded account operation does not alone identify the human actor. Not every event records message content.

D3 capability: requires confirmation. Related guidance →
Sources: Microsoft: audit investigations

Potential content

Recorded acceptance, routing, rejection or delivery events, addresses and identifiers where logged.

Acquisition prerequisites

Authorised service or server access; identify the relevant transport components and preserve available logs.

Retention & configuration

Trace windows, logging settings, rotation, service coverage and administrator access.

Evidential limits

A delivery event is not proof that a named person read the message. Logs may not retain the body or attachments.

D3 capability: requires confirmation. Related guidance →
Sources: Microsoft: message trace FAQ

Potential content

Messages retained by a configured archive or journalling process, with available metadata and collection context.

Acquisition prerequisites

Authority, accessible export route and documentation of the archive scope and configuration.

Retention & configuration

Whether capture was enabled for the relevant period and messages; retention, exclusions and system changes.

Evidential limits

An archive is not necessarily complete. A journal copy and a live mailbox item can differ in representation.

D3 capability: requires confirmation. Related guidance →
Sources: NIST: digital evidence preservation

Potential content

Historical mailbox, server or endpoint data within the actual backup scope and successful restore point.

Acquisition prerequisites

Preserved backup, format details, restoration dependencies and authorised access to required keys.

Retention & configuration

Backup dates, exclusions, retention, integrity, encryption and compatibility of the restoration environment.

Evidential limits

A backup is a snapshot or series of copies, not an assured record of every intermediate message. Restore to a separate working environment.

D3 capability: requires confirmation. Related guidance →
Sources: NIST: forensic techniques

Potential content

Locally retained messages, application data, notifications, downloads or other relevant traces, if present and accessible.

Acquisition prerequisites

Lawful device access and a feasible acquisition method appropriate to its software, condition and encryption.

Retention & configuration

Client behaviour, storage, synchronisation, deletion history, device use and acquisition coverage.

Evidential limits

A notification or application trace is not necessarily a complete message. The device may never have held the relevant material.

D3 capability: requires confirmation. Related guidance →
Sources: NIST: forensic techniques

Potential content

Copies retained by another correspondent, potentially with independently recorded receiving headers and attachments.

Acquisition prerequisites

Lawful access or provision by an authorised custodian; document source, handling and export method.

Retention & configuration

Recipient retention and deletion, forwarding, local saves and account availability.

Evidential limits

Locating another copy is different from recovering deleted structures. Transport and export differences can produce different file hashes.

D3 capability: requires confirmation. Related guidance →
Sources: IETF: Internet Message Format