Our customer was involved in complex legal proceedings where the outcome hinged on the authenticity of historical email correspondence. A key issue was whether certain emails relied upon by the opposing party were genuine records of communication or had been reconstructed or altered after the event.
Given the seriousness of the implications, the client required an independent, robust review of the electronic evidence, presented in a way that could be clearly understood by both legal advisers and non-technical stakeholders.
The Challenge
During proceedings, the opposing party relied on an email allegedly sent at a specific time, which our client stated they never received. At the same time, a separate email sent shortly afterwards was demonstrably present in the client’s mailbox.
The challenge was threefold:
- To determine whether the disputed email showed evidence of genuine transmission through an email system
- To establish whether files described as “native emails” were in fact original system exports or later-created files
- To explain the findings clearly, without speculation, and in a manner suitable for legal scrutiny
This required specialist forensic knowledge of email systems, message headers, authentication mechanisms, and evidential handling.
Our Approach
We conducted an independent forensic technical analysis of the email evidence provided.
Our work focused on:
- Examining native email files (.msg and .eml) rather than screenshots or PDFs
- Analysing full message headers to identify transmission, routing, and authentication data
- Comparing genuine emails against disputed versions to identify structural and metadata differences
- Assessing whether files showed signs of having been transmitted through mail servers or created locally
- Producing a clear, structured report explaining findings in plain language, supported by technical evidence
We ensured not to rely on assumptions or intent. Their analysis was based solely on what the data itself could and could not show.
Why Immervox For Forensic Analysis
We combine deep technical expertise with the ability to explain complex digital evidence in clear, practical terms. We understand both the technology and the legal context in which the findings would be used.
Our approach remains consistent:
- Independent and evidence-led
- Technically rigorous
- Clear, calm, and professional
- Focused on facts, not speculation
For any organisation dealing with disputes involving digital communications, Immervox understand the value of involving forensic specialists early, before assumptions are made or evidence is relied upon incorrectly.
Enquire about an Immervox technical analysis
The Findings
The analysis demonstrated a clear and material distinction between the genuine email and the disputed email relied upon by the opposing party.
In summary:
- The genuine email contained the expected server generated routing and authentication records that are automatically created when an email is sent and received
- The disputed email files contained only authoring information and lacked all server-added transmission data
- Two versions of the disputed email, presented at different times as separate evidence, were shown to be digitally identical copies of the same locally created file
- The disputed email files were inconsistent with the email system normally used by the organisation said to have sent them
These findings could be explained clearly and objectively, without conjecture, and supported by well-established principles of email forensics.
The Outcome
The work provided the client and their legal advisers with:
- A clear technical basis to challenge the authenticity of the disputed email
- Confidence in the integrity and evidential value of the genuine email
- A structured forensic report suitable for legal review and onward disclosure
- Defined next steps for independent corroboration via mail providers or forensic imaging, if required
Importantly, the report allowed non-technical decision makers to understand why certain evidence could not be relied upon, rather than simply being told that it was “wrong”
Services Demonstrated
- Email forensic analysis (.msg / .eml)
- Header, routing, and authentication analysis (SPF, DKIM, DMARC)
- Evidence comparison and duplication detection
- Plain English forensic reporting for legal and commercial audiences
- Guidance on lawful evidence preservation and independent corroboration