Frequently asked questions
Questions, answered carefully.
Direct answers, with the conditions and evidential limits beside them.
Original content baseline 6 November 2026 · Content revision 0.3
What is email forensics, and how does it differ from ordinary IT support?
Scope and suitability
Email forensics examines email material to address an evidential question, such as whether two message versions differ or what a surviving record supports about transmission. It involves documenting sources, collection methods, interpretation and limitations. Ordinary IT support usually aims to restore a working service. The two activities can overlap, but repair, migration or account changes may alter evidence. A forensic instruction therefore begins with the question, lawful authority and an appropriate preservation plan.
Can you examine a single disputed email rather than an entire mailbox?
Scope and suitability
A single message can be the starting point for an assessment. Native message data, its attachments and the circumstances of its collection are more informative than a screenshot alone. The disputed point may nevertheless require recipient copies, surrounding correspondence or independent logs. A narrowly scoped examination can report what that item supports, while explicitly identifying questions that cannot be answered without wider material. The appropriate scope is agreed before full examination.
Which email providers and file types can you assess?
Scope and suitability
The platform pages describe potential evidence from Microsoft, Google, self-hosted systems, Apple clients and other providers. Common supplied formats include EML, MSG, PST, mbox and Maildir, although file condition, encryption and software version affect examination. A provider appearing in the directory is an enquiry category, not a promise of live access or recovery. The initial assessment must establish the actual source, available authority and a feasible examination route for the material concerned.
Do you examine both business and personal email accounts?
Scope and suitability
Both business and personal email may contain relevant evidence. Their available sources can differ substantially: a managed business tenant may have administrator records or preservation features that a consumer account does not provide. Access to an account is not, by itself, sufficient authority to examine every person's correspondence. The proposed work needs an identifiable evidential purpose, an authorised scope and consideration of confidential or privileged material. Feasibility is assessed for the particular account and available copies.
Can you work with our solicitor, internal IT team or existing investigator?
Scope and suitability
An email examination can be coordinated with the people already responsible for the matter. The instruction should identify who can authorise access, provide system information, approve scope and receive findings. IT staff can often clarify retention, migration and account configuration; legal advisers can address authority, disclosure and privilege. Roles and necessary operational changes should be recorded so that collection is understandable and repeatable. Any expert-evidence work requires its own agreed scope and reporting requirements.
What information is needed before you can assess feasibility?
Scope and suitability
Start with the question to be answered, the relevant date range, the provider and whether the account is business-managed or personal. Identify the available devices, native messages, exports, archives and backups, together with any deletion, migration or repair history. State who controls the sources and any known deadline. A brief description is sufficient for an initial enquiry. Do not send passwords, recovery keys, one-time codes or full evidence through the general contact channel.
What permission or authority is required to examine an account?
Scope and suitability
The required authority depends on the account, its ownership and administration, the people affected and the proposed work. Possessing a password does not establish unrestricted permission to collect or examine correspondence. Before collection, the instruction should identify the authorising party, permitted sources, purpose and scope. Employer, employee, shared-account and cross-border questions may require legal advice. D3's acceptance of an instruction must not be treated as a determination of every legal issue affecting access or disclosure.
Can you work with historical or discontinued email systems?
Scope and suitability
Historical material may remain examinable through original stores, exports, backups or associated records, even when the original service is no longer operating. The format, software version, encryption and condition of the data must first be established. An old product name alone does not confirm an available extraction method. Preserve original media and existing copies before attempting conversion or repair. A feasibility stage can identify supported routes and any information lost through earlier migrations.
Can an email be edited or fabricated?
Authenticity and interpretation
Yes. Message files, displayed content and screenshots can be altered or created, while legitimate forwarding, export and migration can also change a message's representation. Examination considers native structure, headers, attachments and corroborating copies or records. An inconsistency may support several explanations and should not automatically be labelled fabrication. The appropriate conclusion describes the observed differences, the reliability of the available sources and the limits of any opinion about provenance or alteration.
Can you determine who personally wrote or sent a message?
Authenticity and interpretation
Email evidence can sometimes support an attribution assessment, but an account name or successful login does not conclusively identify the person operating it. Shared access, delegation, automated systems and compromised credentials may provide alternative explanations. Message records can be considered alongside available account, device and contextual evidence. Any conclusion must distinguish the recorded account, the apparent sending mechanism and the human author, and explain both supporting evidence and unresolved possibilities.
Does a valid DKIM signature prove an email is genuine?
Authenticity and interpretation
No. A valid DomainKeys Identified Mail signature supports a narrower conclusion about signed content and a signing domain under the applicable verification conditions. It does not establish the human author, the truth of the message or the legitimacy of a payment instruction. Not every header is necessarily signed, and interpretation depends on the signature's coverage and the available verification material. Domain authentication is one part of a wider examination, not a standalone authenticity verdict. Later verification can also differ from the receiving system’s original result. A signing key may have been removed or revoked, or the preserved message may differ from the representation originally checked. Record the verification date, method, available key material and signature coverage. An unavailable or failed later check should not, on its own, be described as proof that the original message was fabricated.
Can I rely on an Authentication-Results header saying dkim=pass?
Authenticity and interpretation
Not without establishing where that result came from. Authentication-Results records checks reported by a receiving system; a similar-looking field can be inserted into supplied message data. Identify the reporting service, its trust boundary and how the message was preserved. A result from a trustworthy receiver can support the recorded authentication assessment, but it does not independently identify the human author or establish that the message was truthful. Preserve the native message and supporting receiver records where available.
Does a failed SPF or DMARC check prove fraud?
Authenticity and interpretation
No. Authentication failures can arise from configuration, forwarding, message modification or a genuinely unauthorised sending route. Sender Policy Framework and Domain-based Message Authentication, Reporting and Conformance assess particular domain and transport relationships; they do not determine intent or human identity. The result, its recording system and the circumstances of evaluation need examination. A failure can be relevant evidence, but it should be tested against message routing and other available records before drawing conclusions about fraud.
Can screenshots or a PDF be examined if the original message is missing?
Authenticity and interpretation
Yes. They can show what was presented and may assist with chronology, visible differences or a disputed statement. They usually omit parts of the underlying message structure and may not preserve transport information or attachments in their original form. Keep the submitted material unchanged and record how it was obtained. An examination should describe these limitations and look for independent corroboration, including recipient-held copies, exports or system records, rather than treating the image as a complete original.
Can you prove that an email was delivered or read?
Authenticity and interpretation
Available records may support submission, delivery or a later message-handling event, but those are different propositions. A delivery status notification reports a transport outcome. A message disposition notification may report that a mail application displayed or otherwise processed the message. Even a displayed result does not guarantee that a named person read or understood it. Preserve the original notification and relate it to the message, recipient and reporting system. The conclusion should state the event actually supported and any uncertainty about personal receipt or awareness.
Why do timestamps differ between a mailbox, a header and an export?
Authenticity and interpretation
Different fields can describe different events, such as composition, transport, delivery, storage or export. A client may also display a time in its local timezone, while the underlying value uses another offset. Clock errors, migration and conversion can introduce further differences. Analysis should retain original values and offsets, identify the meaning of each field and state the timezone used for any combined chronology. A time discrepancy alone does not establish alteration or dishonesty.
Can you identify a forged attachment or changed bank details?
Authenticity and interpretation
Comparison can establish differences between available message or attachment versions and may help identify where a payment instruction changed. Relevant sources include native messages, attached files, recipient copies and available account or gateway records. A changed file does not by itself identify who changed it or prove fraudulent intent. The assessment must distinguish observed differences from inferences about their origin, and consider whether a linked document could have changed separately from the email containing its link.
Can you establish whether a message was written using AI?
Authenticity and interpretation
Text alone does not provide a reliable basis for conclusively identifying AI authorship. Automated detectors and stylistic similarities should not be presented as proof that a particular message was generated by AI or written by a named person. Other evidence, such as an authorised account record or a preserved drafting history, may be relevant if available. The report should distinguish direct observations from inference and explain alternative explanations rather than assign an unsupported authorship score.
Can an email's IP address identify the person or their precise location?
Authenticity and interpretation
Usually not on its own. An IP address in a message or log may identify a server, intermediary or network connection rather than the sender's device. Shared networks, virtual private networks, proxies and service infrastructure complicate interpretation. Geolocation results are estimates and are not proof of an exact physical address. Attribution requires context, an assessment of the record's provenance and appropriate corroboration; a recorded IP address alone is not conclusive personal identification.
Why can two genuine copies of a message have different hash values?
Authenticity and interpretation
A cryptographic hash describes the bytes of the particular file being hashed. Two representations of the same communication can differ because of added transport headers, line endings, export formatting, container structure or other transformations. Their whole-file hashes can therefore differ without proving that the substantive communication was fabricated. Conversely, matching hashes support byte consistency, not authorship or truth. Source exports and derived files should be hashed separately, with the algorithm and comparison basis recorded.
What does it mean if an expected message is not found?
Authenticity and interpretation
It means the message was not located within the sources and search conditions examined. It does not automatically prove that the communication never existed. Missing results may reflect deletion, limited retention, an incomplete export, indexing gaps, encryption, permissions or search criteria. A useful report identifies the examined population, methods and known omissions, then considers other surviving sources. The strength of a negative finding depends on how completely those sources address the question being asked.
Can deleted emails be recovered, and what affects the prospects?
Recovery and evidence sources
Sometimes, but recovery cannot be guaranteed. Relevant factors include the service, deletion state, retention and hold settings, local storage, encryption, backups, subsequent use and the time of examination. A surviving recipient copy or archive may fill a gap without constituting recovery from deleted structures. The initial assessment should identify which sources remain available and distinguish an actual recovery method from locating another copy. Data that has been irretrievably purged or overwritten may no longer be obtainable.
Can material be recovered after Trash or Deleted Items has been emptied?
Recovery and evidence sources
Possibly, depending on the system and circumstances. Emptying a visible folder does not have the same technical effect on every service or local store. Other retention mechanisms, backups, archives or correspondent copies may exist, but their presence must be established. Do not assume an enterprise recovery feature applies to a personal account. Avoid restoring or repairing over the only surviving material; record what happened and obtain source-specific advice before further changes.
Can a deleted employee mailbox still contain retrievable evidence?
Recovery and evidence sources
It may, depending on the platform, account lifecycle and preservation arrangements already in place. Possible sources include retained mailbox data, authorised archives, backups, local copies and other correspondents. Deletion of an employee's account does not by itself establish either complete destruction or continued availability. The administrator should provide the relevant dates, configuration and changes. Creating a hold later must not be assumed to recreate material already irretrievably purged, and collection still requires appropriate authority.
Does Microsoft 365 retain every message indefinitely?
Recovery and evidence sources
No universal assumption of indefinite retention is justified. What survives depends on the applicable service, mailbox state, permissions and configured retention or preservation features. Mailbox content, audit records and message-tracing information are separate sources and can have different availability. An assessment should establish the tenant's actual configuration and the relevant event history. A current setting does not necessarily describe the setting at the material time, and preservation applied today cannot be assumed to restore previously lost data.
Does Google Vault contain all deleted Gmail messages?
Recovery and evidence sources
No. Google Vault should not be treated as a universal backup or a guarantee that every deleted message survives. Availability depends on the organisation's entitlements, relevant accounts, configured retention and holds, and the history of the material. Vault and the live mailbox are distinct evidence sources whose search and export limitations must be recorded. A later preservation action does not necessarily recreate previously purged messages, and personal Gmail accounts should not be assumed to have Workspace preservation facilities.
What is the difference between Google Workspace and personal Gmail evidence?
Recovery and evidence sources
Google Workspace is administered within an organisation, while personal Gmail is a consumer account service. The distinction matters because administrator records, permissions and preservation options are not interchangeable. Both may have authorised exports or local copies, but an export is not automatically the full account history. The assessment should identify the actual account type, available administrator access and relevant configuration before proposing collection. A Gmail address or familiar interface alone does not establish which additional sources exist.
Can you examine a PST or OST file without access to the live account?
Recovery and evidence sources
A supplied local file may provide an examination route independent of live account access, subject to its format, condition, protection and contents. A PST and an OST serve different purposes, and neither should automatically be treated as a complete historical mailbox. A cached file may contain only a subset of synchronised data. Preserve the original file and its context before conversion or repair. Feasibility and the limitations of any derived output should be assessed against the actual file.
Can you investigate Linux mail servers or Maildir and mbox data?
Recovery and evidence sources
These sources can be considered where authorised access and a feasible examination method exist. Linux identifies an operating system, not a single email platform: transport software, mailbox services, webmail and stored formats must be identified separately. Maildir and mbox can contain message data, while available logs, queues, archives and backups may answer different questions. Configuration, rotation and subsequent activity affect completeness. The proposed examination must be based on the actual components and preserved material, not the server label alone.
Can you assess Proton Mail, Tuta or other encrypted email?
Recovery and evidence sources
An assessment can consider available authorised exports, accessible local copies and relevant metadata. The provider name does not establish access to message content or deleted data. Different arrangements, including end-to-end encryption, S/MIME, OpenPGP and protected attachments, have different access requirements. A feasible route may require valid credentials, keys or an already accessible copy. No claim of defeating encryption is made, and the directory does not confirm a validated acquisition method for every listed service.
Can archives, backups or another person's mailbox fill a gap?
Recovery and evidence sources
They may contain surviving copies or records absent from the main mailbox. Their coverage, creation dates, retention and provenance need examination, and access must be authorised. A backup may reflect only one point in time; an archive may cover selected traffic; a recipient copy may include different transport information. Finding such material can be valuable, but it should be reported as a surviving copy from that source, rather than automatically described as recovery from deleted mailbox structures.
Are cloud-linked documents included in a mailbox export?
Recovery and evidence sources
Not necessarily. A message may contain a link or reference to a document held in a separate service, rather than the document's bytes. Access permissions, historical versions and the state of the document at the relevant time are separate questions. A current download may differ from what was previously available to a recipient. Preservation should therefore identify the linked service and available version history, with suitable authority, instead of assuming the mailbox export includes the historical document.
Can smartphone and computer evidence corroborate email findings?
Recovery and evidence sources
Potentially. Devices may hold local message data, attachments, application records or other artefacts relevant to a particular question. Their presence and completeness depend on the application, synchronisation, retention, encryption and subsequent use. An account visible on a device does not guarantee that all historical correspondence is stored there. Device examination should be separately scoped and authorised, then correlated carefully with mailbox and server evidence without treating every device timestamp as the same kind of event.
Will collection change the account, its read status or its audit records?
Process and commercial questions
Some collection methods can create access records or affect account state, while others work from existing exports or preserved copies. The effect depends on the service and method and must not be assumed away. The collection plan should identify foreseeable changes, minimise unnecessary interaction and record settings, times, errors and relevant actions. Necessary operational containment may also change evidence. Those changes should be coordinated and documented so that later interpretation can distinguish collection activity from the events under examination.
What should I preserve, and what should I avoid changing?
Process and commercial questions
Retain original material and record what happened, including dates, account changes and any previous collection or repair. Avoid unnecessary deletion, compaction, migration, conversion or restoration over the only surviving copy. Preserve available context such as export settings and correspondence about how files were supplied. There is no universal instruction to disconnect accounts or power devices down. Where compromise is active, coordinate evidence preservation with authorised account protection and containment, and document necessary changes.
How do you protect confidential, personal or potentially privileged material?
Process and commercial questions
Handling arrangements should be agreed before evidence transfer, including authorised recipients, scope, access restrictions and any review or segregation requirements. Potentially privileged material should be identified with the instructing legal advisers; labelling it privileged does not establish its legal status. The initial enquiry should contain only the information needed to assess the matter. Detailed transfer and retention arrangements require confirmation for the engagement. Do not send full mailboxes, passwords or recovery material through an ordinary website enquiry.
How are scope, costs and timescales agreed?
Process and commercial questions
They are established from the question, available sources, volume, condition, access requirements and reporting needs. A limited feasibility stage may be appropriate before committing to a wider examination. The written scope should identify proposed work, exclusions, deliverables and the basis on which additional work would be agreed. This website does not offer fixed recovery prices or guaranteed turnaround times. Any relevant court, commercial or preservation deadline should be disclosed at the outset so that feasibility can be assessed realistically.
Can you guarantee recovery or a conclusive authenticity opinion?
Process and commercial questions
No. The available evidence may be incomplete, altered through ordinary processing or incapable of resolving the disputed point. Recovery depends on the source and its history; an authenticity assessment may identify consistencies, discrepancies and competing explanations without supporting a binary genuine-or-fake answer. The purpose of the assessment is to establish what the evidence reasonably supports and to report the limits openly. An inconclusive finding can still clarify which propositions remain unproven and what further evidence would be useful.
What reports, schedules and native files might be delivered?
Process and commercial questions
Depending on the agreed scope, outputs may include a feasibility opinion, acquisition record, technical report, evidence schedule and identified native or derived files. A schedule can record sources, item identifiers, filenames, recorded correspondents, timestamps, attachments and hashes where available. Bcc, envelope recipients and deletion state are source-dependent fields. The report should explain methods, transformations, omissions and limitations. An expert report or testimony requires separate instruction and should not be assumed to form part of every examination.
Can your findings be used in court or an expert-witness instruction?
Process and commercial questions
An examination can be scoped to assist legal proceedings, with methods, sources and reasoning documented for scrutiny. The appropriate report and any expert role should be agreed with the instructing legal advisers, taking account of the relevant forum and issues. A report's label does not guarantee admissibility, privilege or acceptance by a court. Conclusions must remain within the evidence and the practitioner's expertise, and expert-evidence duties must be considered separately from a client's preferred outcome.
How should I contact you, and should I send passwords or evidence initially?
Process and commercial questions
Use the contact page to provide a short description of the issue, the relevant provider, the available sources and any deadline. Do not send passwords, one-time codes, recovery keys or complete evidence through a general enquiry channel. Identity, authority, conflicts and scope should be addressed before an appropriate transfer arrangement is agreed. This website has no evidence-upload facility, and sending an enquiry does not by itself establish an engagement or an undertaking to act.
How do I know whether D3 has received my enquiry?
Process and commercial questions
If the website offers a form, a confirmation from the form service means it accepted the submission. Contact D3 directly if you need to verify receipt. An email link opens a draft, which you must send from your email application. For an urgent deadline, use the published contact details and explain the timing. An enquiry alone does not create an engagement.