Identify the object in dispute
A filename is not a reliable substitute for the underlying file. An examination may need to establish whether two attachments contain the same bytes, whether document content differs, or which version accompanied a particular message. Embedded messages and embedded objects may also carry relevant context.
Evidence to retain
Preserve the parent message and its attachment together, with the original supplied package where possible. Keep alternative versions separately and document how each was obtained. Opening and resaving a file can change properties, so any necessary handling should be recorded.
- Native messages and attachments, including nested messages.
- Document versions and relevant metadata.
- Available archives, backups or recipient-held copies.
- For cloud links, authorised version-history and access records where they exist.
Possible examination and outputs
An agreed assessment can compare content, hashes and available metadata, and identify the relationship between parent messages and extracted files. Outputs may include a version comparison, an attachment inventory, a chronology and a report explaining supported findings and inconsistencies. Relevant file types and examination methods require feasibility assessment.
What the evidence cannot establish alone
Matching hash values calculated using an appropriate cryptographic algorithm support consistency of the compared bytes. They do not establish who edited a document or whether its statements are true. Metadata can be incomplete, editable or affected by conversion. A current cloud document is not automatically the content available to the recipient at the relevant time. A link in a mailbox export may provide neither the historical file nor its access history.
Before submitting material
Describe the disputed alteration, the messages concerned and the file types held. State whether the item was attached, embedded or linked. Agree authority and transfer arrangements before supplying files, especially where a link could expose additional confidential material outside the agreed scope.