Begin with an inventory
Identify the live service, account type, client applications, computers, phones, archives, backups and copies held by other correspondents. Record who controls each source and whether lawful access is available. The same message may exist in several representations.
- Message content: native files and mailbox collections.
- Activity records: authorised audit data and transport logs.
- Surviving copies: endpoints, archives, backups and recipients.
Keep source and interpretation separate
A file hash supports consistency of bytes against a recorded reference. A delivery record supports a transport event. Neither alone establishes human authorship or that a particular person read the message. Correlate independent sources and record alternative explanations.
An agreed evidence schedule
A schedule can identify the source and custodian, item identifier, native filename or path, recorded sender and recipients, subject, timestamps and offsets, attachments, hash algorithm and value, extraction method and limitations. Bcc, envelope recipients and deleted status are source-dependent.
Illustrative schedule entry
Fictional example: item E-001, supplied file invoice.eml, accounts@example.com to recipient@example.org. An examiner would record the actual extraction method, relevant time fields and computed hash values. No invented hash or authenticity result is assigned to this illustration.