Explore
Start with your situation
12 hypothetical instruction types that identify possible sources, preservation considerations and limits.
Read more →Knowledge collection
Understand what email evidence can tell you
Practical explanations of message structure, preservation, interpretation and evidential limits. Explore 20 guides, 42 FAQs and 75 glossary terms.
Original content baseline 6 November 2026 · Content revision 0.3
No results found. Try a broader term or clear the filters.
Explore
Frequently asked questions
42 direct answers covering suitability, interpretation, recovery and the engagement process.
Read more →Explore
Email evidence glossary
75 terms explained, including the limitations that matter in an examination.
Read more →Evidence explained
Native email or screenshots: what is the difference?
A screenshot records an appearance. A native message can retain structure that helps explain how the message was represented, routed and stored. Both may be useful, but they answer different questions.
Read more →Evidence explained
What email headers can tell you
Headers can help explain addressing, routing and message handling. Interpretation depends on which system created each field and whether that part of the record can be trusted.
Read more →Evidence explained
SPF, DKIM and DMARC: useful signals, limited conclusions
These mechanisms help assess use of email domains. A passing result does not establish the human author or the truth of a payment instruction.
Read more →Evidence explained
Why email timestamps can disagree
A message can carry several times for different events. A useful chronology identifies each event, preserves the source value and states the display timezone.
Read more →Evidence explained
Message-ID and email threading
Identifiers and reply references can help reconstruct conversations. They do not establish authenticity or guarantee that every message in a conversation has survived.
Read more →Evidence explained
PST and OST: why the distinction matters
PST and OST files can be valuable local evidence. Neither filename proves that the file contains a complete account history.
Read more →Evidence explained
EML and MSG: two message representations
An EML or MSG file may preserve more detail than a screenshot, but the formats are different and conversion can change what is retained.
Read more →Evidence explained
mbox and Maildir evidence
These mailbox storage approaches organise messages differently. Preserve the surrounding context as well as the apparent message content.
Read more →Evidence explained
Deletion, retention and holds
Deleting a message from view is not always the same as permanently removing every surviving copy. Equally, a later hold cannot be assumed to recreate material already lost.
Read more →Evidence explained
Google Workspace and personal Gmail
A familiar Gmail interface can sit behind different account arrangements. The available administrative, retention and export sources must be identified for the specific account.
Read more →Evidence explained
Exchange Online and Outlook.com
Exchange Online is a managed business service. Outlook.com is a consumer email service. Outlook also names client applications, so the name alone is insufficient to define an examination.
Read more →Evidence explained
A mailbox export is not complete preservation
An export is the output of a particular operation. Its usefulness depends on what was selected, accessible and successfully collected.
Read more →Evidence explained
An attachment and a cloud link are different evidence
A conventional attachment can travel within the message. A cloud link points to material held elsewhere, which may change or become inaccessible.
Read more →Evidence explained
Shared mailboxes and delegated access
A message appearing to come from a mailbox does not establish which person operated it. Shared access, delegation and automation must be considered.
Read more →Evidence explained
Email spoofing or account compromise?
A misleading sender identity and unauthorised use of a real account are different explanations. Investigation should test both rather than decide from appearance alone.
Read more →Evidence explained
What a missing search result does not prove
No result means that the search did not return a match within its actual scope. It does not automatically mean that a message never existed.
Read more →Evidence explained
How migration can affect email evidence
Migration can change storage, identifiers and presentation. Differences between old and new copies require explanation before they are treated as deliberate alteration.
Read more →Evidence explained
Hashes and chain of custody
A cryptographic hash helps compare bytes. A custody record explains handling. They support different parts of an evidence account and neither proves that an email's contents are true.
Read more →Evidence explained
Encrypted email: access routes and limits
Encryption must be assessed at the correct layer. A provider's storage protection, end-to-end encrypted content and a password-protected attachment present different access questions.
Read more →Evidence explained
What to prepare for a first consultation
Begin with the evidential question, the relevant systems and the material you already hold. A concise factual outline is more useful than sending an entire mailbox without an agreed procedure.
Read more →