Start with the disputed proposition

A useful instruction identifies the precise concern: changed wording, a substituted attachment, an unusual date, a disputed sender or a message absent from another mailbox. These are different questions. An examination should distinguish the integrity of the supplied file, its provenance, its transmission history and the identity of the person who acted.

Evidence to assess

Retain the message in its existing form and describe how it was obtained. Native message files, mailbox copies, relevant attachments and records held independently by other correspondents may permit a more substantial assessment than a screenshot alone.

  • Message headers and MIME structure, the format used to organise message bodies and attachments.
  • Related messages and available transport, gateway or account records.
  • Original attachments, alternative versions and the chronology of collection or conversion.

Possible findings and deliverables

An agreed technical report can identify consistencies, anomalies, competing explanations and questions requiring further evidence. A comparison schedule may show precisely which fields or attachment bytes differ. Findings should separate direct observations from interpretation and state the effect of missing sources.

Limits beside the conclusion

Matching hashes support consistency of the compared bytes. They do not establish authorship or truth. A valid DKIM signature concerns the signing domain and the signed elements; it does not identify the human author. Failed validation can have explanations other than fabrication. A conclusive genuine-or-fake verdict may therefore be unavailable.

Before the first discussion

Provide a short description of the disputed proposition, the relevant dates, the email platform and the forms of evidence held. Do not forward the only copy as a substitute for preserving it. Agree authority, scope and an appropriate transfer method before submitting substantive evidence.

Sources & further reading

Primary references support the technical explanation. They do not establish D3 validation of a particular method.