A clearer language for email evidence.

An additional address associated with a mailbox or routing destination.

Evidential limit: Several addresses can reach one mailbox, so an address alone is not a separate person or account.

Authenticated Received Chain, a mechanism for carrying authentication assessments through participating intermediaries.

Evidential limit: Interpretation depends on the recorded chain and trust in participating systems; it is not a personal-authorship certificate.

A store used to retain email outside, or in addition to, its ordinary working location.

Evidential limit: The term describes many arrangements with different selection, retention and export properties.

A file or other item included within a message's stored or transmitted content.

Evidential limit: A displayed filename does not establish the file's content, provenance or authorship.

A record of selected events generated by a system for administration or accountability.

Evidential limit: Coverage, permissions, event meaning and retention differ; absence from a log is not automatically absence of activity.

A message header carrying a system’s reported results of email-authentication checks.

Evidential limit: Its evidential value depends on the reporting system and preserved trust context. The presence of pass text alone does not establish that a trustworthy receiver generated it.

Sources: RFC 8601: Authentication-Results and trust boundaries (checked 2026-11-07)

A copy made to support restoration or resilience, often reflecting a particular point in time.

Evidential limit: It may be incomplete, overwritten or unsuitable for answering every historical question.

Blind carbon copy, used to address recipients without displaying them to all other recipients in the ordinary message view.

Evidential limit: Bcc information may be absent from recipient-held copies and cannot be assumed available in every export.

Misuse of business communication or related identities to facilitate deception, often including payment diversion.

Evidential limit: The description does not establish whether an account was accessed, an address spoofed or a particular offender identified.

Documentation of evidence identification, possession, transfers and handling through the relevant process.

Evidential limit: A custody record supports provenance and accountability but does not prove the truth of the underlying content.

A reference or link to a file stored in a separate online service, presented as part of an email workflow.

Evidential limit: The current linked file may differ from the version accessible at the relevant time.

Identifying items treated as duplicates under a defined comparison method to organise review or production.

Evidential limit: The comparison basis matters; removing a copy may also remove distinct custodian or contextual information.

A person or account granted permission to perform specified actions on another mailbox.

Evidential limit: Permission and its scope can change; present delegation does not establish historic use.

A structured report about the delivery status of an email for one or more recipients.

Evidential limit: Identify the reported action, recipient and reporting system. A transport outcome does not establish that a named person read the content.

Sources: RFC 3464: Delivery status notifications (checked 2026-11-07)

A cryptographic mechanism for checking signed data against a key and detecting certain changes to that data.

Evidential limit: Identity, key control, signature scope and verification conditions must be assessed separately.

DomainKeys Identified Mail, a mechanism using a domain-associated signature over selected message elements.

Evidential limit: A valid result concerns signed elements and verification conditions, not every header or the human author.

Domain-based Message Authentication, Reporting and Conformance, a framework relating domain authentication and alignment to handling policies.

Evidential limit: Pass or fail is not a complete finding about fraud, identity or message truth.

The identification, preservation, collection, review and production of electronically stored information for a legal or investigative purpose.

Evidential limit: Technical processing alone does not determine relevance, privilege, disclosure duties or admissibility.

Software used to access and manage email, such as Outlook, Apple Mail or Thunderbird.

Evidential limit: The client is distinct from the hosting service and may retain only selected or cached material.

Grouping related messages into conversations using identifiers, subject patterns, quoted content or other criteria.

Evidential limit: A reconstructed thread may be incomplete or incorrectly grouped and requires appropriate validation.

An email included as an item inside another message, rather than merely quoted as text.

Evidential limit: Its inclusion does not independently verify its origin or prove it was previously transmitted.

A common file representation of an email message, typically containing headers, body and MIME-encoded parts.

Evidential limit: The extension does not authenticate provenance or establish that all original transport information survives.

A message storage format associated with Apple Mail, containing message data and additional storage information.

Evidential limit: A single file may require surrounding store context to interpret associated state and attachments correctly.

Protection designed so that message content is readable by the communicating endpoints rather than intermediate service operators.

Evidential limit: Available metadata or exports do not establish that encryption can be bypassed or deleted content recovered.

The sender and recipient information used during message transport, distinct from the addresses displayed in the message.

Evidential limit: A saved message does not necessarily preserve the complete transport envelope.

Microsoft's hosted organisational email service. Mailboxes and administrative records can provide different evidence sources.

Evidential limit: A mailbox export is not automatically a complete account history or an export of all tenant logs.

Exchange software operated on an organisation's infrastructure, potentially alongside hosted services in a hybrid arrangement.

Evidential limit: Version, configuration, storage condition and available backups determine the examination route.

A documented process for obtaining evidence while recording the method, scope, integrity checks and relevant limitations.

Evidential limit: A cloud export is not automatically a complete forensic image or the entire history of an account.

A mailbox instruction that redirects or copies messages meeting specified conditions to another destination.

Evidential limit: A current rule does not alone establish when it was created, who created it or every message affected.

Google's email service, available in personal accounts and within Google Workspace.

Evidential limit: The familiar interface does not identify the account's administrative or preservation capabilities.

Google's managed organisational service environment, which can include Gmail and administrator-controlled features.

Evidential limit: Workspace capabilities must not be assumed to exist for personal Gmail or every organisational subscription.

A fixed-length value calculated from data using a specified algorithm, commonly used to compare byte consistency.

Evidential limit: Matching hashes do not prove who authored a message or whether its content was true before collection.

A structured message field recording information such as addresses, subject, dates or transport details.

Evidential limit: Individual header values may be supplied or modified by different systems and are not uniformly trustworthy.

Internet Message Access Protocol, commonly used by clients to access and synchronise server-held email.

Evidential limit: A synchronised client may not contain every folder, historical item or provider-side record.

A header that can identify the message to which a reply relates.

Evidential limit: Its presence supports a stated relationship, not proof that the referenced original is authentic or available.

A separately maintained record or copy of selected email traffic under a configured journalling arrangement.

Evidential limit: Coverage must be established; a journal is not automatically a complete record of every communication.

A preservation instruction or configured mechanism intended to retain relevant material for a legal matter.

Evidential limit: Its technical effect is source-specific and cannot be assumed to recreate irretrievably purged data.

A domain selected to resemble another name, potentially through spelling or visual similarity.

Evidential limit: Similarity is an observation; intent, use and control require supporting evidence.

Software responsible for placing accepted messages into a recipient's mailbox or local store.

Evidential limit: Recorded delivery is distinct from personal receipt, reading or understanding.

Software that accepts and routes email between systems, such as a transport service on a mail server.

Evidential limit: Its logs may describe routing without preserving complete message content.

The application through which a user composes, reads and manages email; another term for an email client.

Evidential limit: Its display is a representation of evidence and may omit headers or other underlying data.

A logical store of messages and associated folders or labels for an account or shared purpose.

Evidential limit: Its present contents may exclude deleted, archived, unsynchronised or separately retained material.

A mailbox storage approach using individual message files arranged in defined directories.

Evidential limit: Filenames and directory states require system-specific interpretation and do not alone prove user actions.

A family of mailbox formats that store multiple messages sequentially within a file.

Evidential limit: Variants and export transformations require care when identifying message boundaries and interpreting metadata.

A structured report about how a mail application handled a message, such as displaying, deleting or processing it.

Evidential limit: A displayed notification does not guarantee that the content was read or understood. Assess the notification’s provenance and its relationship to the original message.

Sources: RFC 8098: Message disposition notifications (checked 2026-11-07)

Provider or transport records describing selected stages in a message's processing or delivery.

Evidential limit: A trace may omit message content and does not establish that a named person read it.

An identifier generally intended to distinguish a message and assist with referencing or conversation grouping.

Evidential limit: It can be duplicated, missing or fabricated and does not independently authenticate a message.

Information describing an item or its handling, such as recorded addresses, dates, identifiers and file properties.

Evidential limit: Metadata can be incomplete or transformed; each field requires source-specific interpretation.

Microsoft's collection of subscription services, which can include organisational email and associated administration features.

Evidential limit: The subscription name alone does not establish available licences, logs, retention or collection permissions.

Multipurpose Internet Mail Extensions, rules for representing email content such as different text encodings and attachments.

Evidential limit: Equivalent displayed content can have different encoded bytes, affecting comparisons and whole-file hashes.

A Microsoft message-file format that can hold an individual Outlook item and associated properties.

Evidential limit: Export and application behaviour affect the properties retained; it is not identical to every transport representation.

Authentication requiring more than one distinct type of evidence of identity.

Evidential limit: A successful authentication event is not conclusive proof of the human operator or subsequent message authorship.

A Notes Storage Facility database format associated with Notes and Domino applications, including mail.

Evidential limit: Version, access controls, encryption and database condition affect feasible examination.

An authorisation framework through which an application can receive defined access without directly using a user's password.

Evidential limit: A granted permission or token does not establish who performed every resulting action.

A standard for cryptographic protection, including signing and encryption of messages and files.

Evidential limit: Accessible ciphertext does not imply access to plaintext; keys and signature context affect interpretation.

An Offline Storage Table file used by some Outlook configurations as a local synchronised store.

Evidential limit: It may contain only cached data and is not automatically an independent, complete historical archive.

An association between a containing item and an included item, such as an email and its attachment.

Evidential limit: Separating items during processing can obscure context unless the relationship is preserved and reported.

Post Office Protocol version 3, commonly used to retrieve messages from a server.

Evidential limit: Client settings and earlier retrieval can affect which copies remain on the server or device.

A Personal Storage Table file used by supported Outlook workflows to store email and other items.

Evidential limit: A PST can be selective, altered or incomplete; its existence does not prove a full mailbox collection.

A notification associated with a client or service reporting a message-handling event commonly described as reading.

Evidential limit: It does not conclusively prove that a named person read or understood the content.

A header added by a mail-handling system to describe a transport step and associated time information.

Evidential limit: Trust depends on the system that added it and the preserved context; an entire chain is not automatically reliable.

An Exchange storage area associated with particular deletion and preservation behaviours.

Evidential limit: Its contents and accessibility depend on mailbox state, configuration, permissions and retention history.

A header that can list message identifiers associated with a conversation's earlier messages.

Evidential limit: Thread reconstruction can remain incomplete or misleading where identifiers are missing or inconsistent.

Rules governing how long specified material is kept and when it may be removed.

Evidential limit: Actual survival depends on scope, configuration and history; a present policy does not prove past preservation.

A header commonly recording a transport return address used for delivery-related notifications.

Evidential limit: It need not match the visible From address and does not identify the human author.

Secure/Multipurpose Internet Mail Extensions, a framework for digitally signing and encrypting message content using certificates.

Evidential limit: Examination may depend on suitable keys and certificates; a signature does not establish the truth of the content.

A mailbox intended for use by more than one authorised person or process.

Evidential limit: A message associated with it does not, by itself, identify the individual responsible.

Simple Mail Transfer Protocol, used for submitting and transferring email between systems.

Evidential limit: A transfer event does not by itself establish that a person read the resulting message.

Sender Policy Framework, a mechanism for checking whether a sending system is authorised for an evaluated domain.

Evidential limit: It does not establish human authorship or the truth of message content.

Making a communication appear to originate from an identity or address that it does not legitimately represent.

Evidential limit: Visible address similarity alone does not establish the technical mechanism or the offender.

An organisation's administered environment within a cloud service.

Evidential limit: Tenant membership does not confer unrestricted authority or technical access to every account and record.

A recorded date and time associated with a particular event or property.

Evidential limit: Its meaning, clock source and timezone must be identified before combining it with other times.

The stated difference between a local time value and UTC, such as plus eight hours.

Evidential limit: An offset is not a precise physical location and may depend on date-specific clock rules.

Coordinated Universal Time, a common reference used when comparing events across timezones.

Evidential limit: Converting display times to UTC does not correct inaccurate clocks or establish the event represented.

An interface for accessing email through a web browser.

Evidential limit: The web interface does not establish where complete mailbox content or historical records are stored.