Map the actual mail system

Postfix, Exim and Sendmail are transport components. Dovecot and Courier may provide mailbox access or delivery services. Roundcube is webmail software. A server can combine several components, and the web server need not hold the authoritative message store. Identify each role, version and host before planning collection.

  • Locate the mailbox service, transport service, webmail host and any external gateway.
  • Identify virtual machines, containers, storage volumes, archives and backup repositories.

Preserve stores and context together

Maildir commonly stores messages as separate files; mbox stores multiple messages within a mailbox file. Dovecot configuration can place mailbox data and indexes in different locations, so a familiar directory name is not enough to establish collection scope. Retain the relevant configuration and account mappings alongside acquired material.

Postfix records transport activity in logs whose location depends on its logging configuration. Queues and delivery records can add context, but are different from a permanent journal of message content.

What the evidence can and cannot show

Messages may support content and structural comparison. Transport records may support a recorded hand-off, attempted delivery or failure. Neither a server log line nor a mailbox flag alone proves that a named person read the message. Rotated logs, clock differences and changes to infrastructure can leave significant gaps.

Current configuration does not necessarily establish historical configuration. Record the basis for any assumption about logging, retention, time synchronisation or storage layout during the disputed period.

Collection prerequisites

The authorised administrator should identify relevant machines, tenants and storage boundaries, and explain available access and encryption. Agree a method that accounts for live writes and operational constraints. Preserve backups before restoring them, and avoid repair, compaction or migration over the only surviving source.

  • Record software versions, acquisition times, errors and necessary service changes.
  • Assess third-party or multi-tenant information before collecting a broader server image.

An environment-specific assessment

Possible outputs include a source inventory, message schedule, qualified transport chronology and comparison of surviving stores. The initial assessment must establish whether the particular format and version can be examined. Listing a system here is an enquiry category, not confirmation that every deployment or historical variant is supported.

Sources & further reading

Primary references support the technical explanation. They do not establish D3 validation of a particular method.