Common evidential questions

Start with the situation

These are hypothetical instruction types, not client case studies. Each identifies possible sources, preservation considerations and limits.

Original content baseline 6 November 2026 · Content revision 0.3

Search this collection

Scenario

An email is alleged to have been altered

Define the alleged alteration, preserve each version and assess the message together with independent records.

Scenario

Reconstruct when the instruction changed and assess whether the available evidence supports spoofing, compromise or another mechanism.

Scenario

Check the account history and available sources before attributing an apparent gap to deliberate deletion.

Scenario

Establish which historical sources survive and document the changes that may explain differences between collections.

Scenario

Compare the provenance and contents of each collection before drawing conclusions from missing or different messages.

Scenario

Preserve the material that exists, establish how it was created and assess whether underlying or corroborating sources can still be located.

Scenario

Separate the mailbox identity from the person who may have acted, using available delegation and activity records.

Scenario

Assess the event in context and coordinate preservation with authorised account protection.

Scenario

Identify the relevant sources and preservation scope with the instructing team before routine changes remove useful material.

Scenario

Distinguish message creation, transport, delivery and human reading, and examine the records relevant to the actual proposition.

Scenario

Assess the format, condition and provenance of surviving material before deciding how it can be examined.

Scenario

Treat the message and the linked document as related but separate sources, with distinct access and historical availability questions.