The question to resolve
A difference in wording, dates or attachments may be material, but it does not identify how the difference arose. Establish which version is disputed and whether the allegation concerns visible content, the underlying message file or its claimed sender. Keep the original allegation distinct from the observations.
Useful evidence and preservation
Preserve all supplied versions, original attachments, surrounding correspondence and available sender or recipient copies. Retain the way each item arrived and any export or conversion history. Avoid replacing the only original with a forwarded message or a newly created PDF.
Limits and assessment
Screenshots can document appearance but usually omit underlying structure. Different file hashes can reflect representation changes. A valid domain authentication signal does not prove personal authorship or the truth of the content. An authenticity assessment should compare the disputed elements, seek corroboration and explain alternative causes. Begin with the exact passage or property challenged and the sources currently held. The output may be a comparison schedule and a qualified technical opinion rather than a definitive fraud verdict.