Identify the account behind the application

An Apple Mail screen may display iCloud, Microsoft, Google or another provider's account. The application name alone does not identify the relevant server records or retention arrangements. Establish the account provider, device, operating-system version and whether messages were stored locally or synchronised.

  • Distinguish local mailboxes from provider-hosted mailboxes.
  • Identify other Macs, mobile devices and historical backups that may contain relevant copies.

Possible sources

Sources may include authorised account material, local message stores, application indexes, existing exports and backups. Apple documents mailbox export from Mail on Mac in mbox format. The selected mailbox and the material available to the application still define what an export can contain.

Local files, including EMLX where produced by the relevant Mail version, require contextual examination. An index entry or cached representation is not necessarily a complete message with every attachment.

A synced view is not a historical archive

The current view can reflect synchronised changes, selective downloads or account removal. A missing item on one device does not by itself establish that no other copy survives. Conversely, the existence of an iCloud account or a device backup does not establish that the disputed message is present and retrievable.

A cloud-document link should be assessed separately from an attached file. Access to the document today does not establish what a recipient could see at the relevant time.

Preserve before rebuilding or importing

Avoid unnecessary mailbox rebuilding, account removal, migration or import over the source while a preservation method is being agreed. Keep original exports and record how they were produced. If operational changes are necessary, document the reason, time and person responsible. Use an authorised collection route and retain the original material before examining working copies.

  • Describe the devices and account types in the first enquiry.
  • Do not send Apple Account passwords, recovery keys or verification codes.

Scope and possible outputs

An examination may document available messages, compare copies or support a qualified communication chronology. The report should distinguish provider data, client artefacts and backup material. Device access, encryption, version and evidence condition may constrain the result; feasibility and D3's applicable examination route must be established before a recovery or collection commitment.

Sources & further reading

Primary references support the technical explanation. They do not establish D3 validation of a particular method.