Rob Walton provides independent email expert witness and forensic email analysis services for attorneys, law firms and courts in the United States and internationally. With more than 30 years’ hands-on experience in email systems, SMTP, Microsoft Exchange and Microsoft 365, he provides technical analysis of disputed emails, email authenticity, delivery, headers, metadata and alleged manipulation.
Rob Walton is a highly credible expert witness, and adheres to CPR35, and the Daubert standards.
Rob is a member of the High Technology Cyber Investigation Association (HTCIA). HTCIA is the premier global professional organization providing individuals utilizing investigative techniques and technology with innovative networking and training.
Rob is a member of the International Association of Computer Investigation Specialists (IACIS).
IACIS is an international organization dedicated to digital forensics.
Watch expert email forensics video content on Rob’s dedicated YouTube channel for Global Email Forensics.
Rob Walton is a member of the Expert Witness Institute (EWI). Supporting the proper administration of justice and the early resolution of disputes through high-quality expert evidence from specialists.
I provide independent email expert witness and email forensic services to attorneys, law firms and litigation teams across the United States, supporting both federal and state court matters. With more than 30 years of professional experience in enterprise email systems, including Microsoft Exchange, Microsoft 365, Google and SMTP gateways, I specialise in the technical examination and authentication of disputed email evidence.
My work includes analysis of email headers, EML and MSG files, PST mailboxes, SMTP routing, Microsoft 365 evidence, metadata and email delivery records. I can assess whether the available technical evidence supports the authenticity, and provenance, of an email. This allows me to identify inconsistencies that may indicate alteration, manipulation or an incomplete evidential record.
For US litigation, my forensic work is undertaken using a documented, repeatable and technically defensible methodology, with findings clearly separated from assumptions and limitations. This approach is particularly important when expert evidence may be assessed under the Daubert standard and applicable Federal Rules of Evidence.
I can provide independent expert reports, technical review of opposing expert evidence, deposition support and expert testimony. My reports are designed to explain complex email technology clearly to attorneys, judges and other non-technical readers while retaining the technical detail necessary for the conclusions to be independently evaluated.
My expert witness services for email delivery and email fraud are based on experience and credibility. Do not hire a bad expert witness.
Many of the cases I work on involve disputes over whether an email was sent, or received. Email is an electronic record, and requires various different evidencial artefacts for any expert provenance view. Electonic records related to emails do not just involve the email itself. Email transport is an important area related to veracity, with awareness required over limited email transport log retention for modern cloud based email systems.
An email that is received by a mailbox on a different email system will contain a set of email headers. These email headers are valuable for an email forensic perspective. Email header forensic analysis is often a key area of interest for an email expert witness. The email headers can help establish provenance of a received email. Preservation of email headers can vary dependingon the provided email forensic evidence. Supporting email forensic evidence can change the provenance of a presented email.
Emails are electronic records, and can be subject to fraudulent representation. There are various markers that increase the likelihood of a presented email being fraudulent. An email message can be exported as an EML file, which is a text file. Any text file can easily be edited using publicly available software. This means that key areas of an email message can be modified, such as email body, time, and date. With the right email expert witness involved it is unlikely that a fraudulent email will escape notice.
Provides credible views on matters of email forensics, based on knowledge and experience of email systems, email delivery and email transport.
Depending on the evidence, the level of provenance can be determined. Repeatable tests help support any provenance view. Often, a repeatable test can help support what the email evidence does not show.
Sometimes, yes. Depends on the available evidence.
As much as possible. Cloud email systems do not always retain message logs. Email messages may be in EML,MSG or PST format.
Yes. Access to Microsoft 365 Tenant is preferred for read-only.
Yes.
Yes.
I am based in New Zealand, and travel as required.
I have worked with email systems, and email technologies, for over 30 years. In addition, I am experienced in the area of email forensics, and litigation matters. My credibility extends into the witness box for court matters.
Yes, please visit the blog part of this website for relevant articles.
In my work as an expert witness for email delivery matters, I see many cases where fraud is being alleged. A legal matter often concerns whether an email has been sent, or has been received. Read more
As an expert witness in the email forensics field, I get asked to examine various types of digital evidence. Not all email evidence is equal however. For example, in a recent email expert witness case, Read more
In the area of digital email forensics a common activity is to prove (or disprove) an email is valid. How can an email be proven to be valid, and not a forgery? Forensically, the level Read more