Introduction
When an email becomes evidence in an email forensic investigation, fraud investigation, litigation or commercial dispute, simply producing a copy of the message may not be enough. Whether the evidence is an EML or MSG file can affect what technical evidence is available to an investigator and, consequently, what conclusions can safely be drawn about the email’s origin, transmission and authenticity.
Two of the most common individual email formats encountered in email forensics are EML (.eml) and Microsoft Outlook MSG (.msg). Although both can represent an email that looks virtually identical when opened by a user, they store information differently. Those differences can become particularly important when investigating an allegedly fraudulent email, or where a party claims that an email was fabricated, altered, spoofed or never actually transmitted.
For lawyers, investigators and organisations dealing with disputed emails, the key question is therefore not simply “EML vs MSG: which is better?” The more important question is which format preserves the evidence needed to test the claimed history of the message.
What Is an EML File and Why Is It Useful in Email Forensics?
An EML file is a representation of an Internet email message. Its structure normally consists of message header fields followed by the message body, with MIME used where necessary to represent HTML content, alternative message bodies and attachments.
For forensic purposes, one of the most important features of a properly preserved received email is that its headers may contain evidence created while the message passed through email infrastructure. Depending upon the sending and receiving systems, this can include Received headers, Message-ID, Return-Path, MIME information, DKIM signatures, Authentication-Results fields and other server-specific headers.
Received headers can be particularly valuable because mail systems normally prepend trace information as a message moves through the transport environment. An examiner may therefore be able to reconstruct aspects of the route taken by the message and compare the timestamps, server names, IP addresses and message identifiers with other available evidence.
An EML file is not, however, automatically authentic merely because it has an .eml extension. EML content is capable of being created or edited. The forensic question is therefore not simply, “Is this an EML file?” but rather, “Is the internal structure and metadata consistent with the history being claimed for this particular email?”
EML file format is used by Outlook for Mac when exporting emails to the file system.
What Is an MSG File?
An MSG file is the Microsoft Outlook item format. Rather than simply storing an Internet message as a sequence of RFC-style header fields and a body, an MSG file represents a Microsoft message object using properties, streams and subobjects associated with recipients and attachments.
This means that an MSG file can contain useful information that is not presented in the same way as an EML file. MAPI properties may record message characteristics, timestamps, recipients, attachment information and other data useful to a forensic examiner.
MSG should therefore not be regarded as an inherently inferior forensic format. In some investigations its MAPI properties can provide valuable additional evidence. The important issue is understanding what the MSG represents, how it was created or exported, and which properties were retained during that process.
EML file format is used by Outlook for Windows (Classic) when exporting emails to the file system.
EML vs MSG: What Is the Main Forensic Difference?
At a high level, an EML file is particularly useful for examining the Internet message, MIME content and email headers, while an MSG file can preserve additional Microsoft Outlook and MAPI properties. Neither format is automatically more authentic than the other.
| Forensic consideration | EML file | MSG file |
|---|---|---|
| Internet email headers | Usually directly accessible | May be stored within MAPI properties |
| MIME structure | Directly represented | Represented through Outlook/MAPI structures |
| Outlook/MAPI properties | Limited | Potentially extensive |
| Attachments | Preserved as MIME parts | Preserved as attachment objects |
| Human-readable raw structure | Generally easier to inspect | Requires parsing of structured storage |
| Can potentially be altered | Yes | Yes |
| Useful for forensic investigation | Yes | Yes |
The evidential value depends on the message’s provenance, how it was acquired or exported, whether information was lost during processing, and whether the contents can be corroborated against independent evidence.
Why Does EML vs MSG Matter in a Fraud Investigation?
Consider a dispute in which one party produces an email and claims that it was received from another person on a particular date. The opposing party alleges that the email was fabricated.
The visible fields displayed in Outlook—such as From, To, Subject and Date—are only part of the available evidence. A screenshot or PDF might reproduce these fields convincingly while revealing very little about whether the message actually passed through an email system.
A forensic examiner would therefore normally want access to the underlying electronic message rather than relying solely upon a screenshot, PDF or printed copy.
If a purported received EML contains a coherent sequence of Received headers and other transport metadata, those fields may provide evidence consistent with the message having travelled through the identified mail systems. The examiner can assess whether the servers, timestamps and routing sequence make technical sense and whether they correspond with other evidence.
Conversely, if an email alleged to have been externally received contains only basic composition fields and lacks the transport information that would ordinarily be expected in the circumstances, that absence may require further investigation. It does not, by itself, prove fraud: headers can be lost through conversion, migration, export or processing. The examiner should establish whether there is a legitimate technical explanation before reaching a conclusion.
Email Headers and Received Headers in a Forensic Investigation
Received headers are among the most useful fields in many email investigations. Internet mail standards provide for trace information to be added as messages move through the transport system. A typical externally received message may therefore contain multiple Received fields representing different stages of its journey.
These fields can assist an examiner in answering questions such as:
- Which systems appear to have handled the email?
- Does the sequence of servers make technical sense?
- Are the timestamps chronologically plausible?
- Does the originating infrastructure correspond with the claimed sender’s environment?
- Is there evidence that a security gateway or cloud email service processed the message?
- Are important stages of the alleged delivery path unexpectedly absent?
No single header should normally be considered in isolation. A reliable examination considers the header set as a whole and, where possible, corroborates it against independent evidence.
SPF, DKIM and DMARC Evidence in Fraudulent Email Investigations
Modern email systems can add further authentication evidence. For example, an Authentication-Results header may record the results of SPF, DKIM and DMARC checks performed by a receiving system.
DKIM can be particularly relevant because a valid signature can provide evidence that specified signed portions of a message have not changed since the signature was applied. However, DKIM must be interpreted carefully. A DKIM pass is not a universal guarantee that every aspect of an email is genuine, and the absence of DKIM does not establish that an email is fraudulent.
Similarly, SPF relates primarily to whether an IP address was authorised to send mail for the relevant envelope domain at the time of evaluation, while DMARC considers authentication and domain alignment. These mechanisms provide pieces of technical evidence rather than a simple forensic verdict of “genuine” or “fake.”
Can Email Forensics Show Whether an Email Was Actually Sent or Received?
One particularly important forensic question is whether a disputed message was actually received through an email system or whether it may instead have been created locally.
A message created or saved locally can contain convincing From, To, Date, Subject and body information without necessarily possessing the transport metadata expected from an externally delivered message. Consequently, visual appearance alone cannot establish transmission.
An investigator should examine the internal message structure and ask whether it is consistent with the alleged lifecycle of the message. If the evidence is said to be a received email, the examiner may reasonably look for evidence associated with receipt. If it is said to be a draft, sent item or locally generated message, a different set of properties may be expected.
This distinction is especially important where the existence or wording of a particular email is central to an allegation of fraud, misrepresentation, contractual authority, payment diversion or business email compromise.
MSG Files and MAPI Properties
MSG files require a different examination approach. An investigator should not simply convert the MSG to another format and discard the original. The MSG itself may contain MAPI properties and internal structures relevant to determining the characteristics of the message.
These properties may assist in understanding how Outlook or Exchange represented the item, its recipients, attachments and various timestamps. Depending on the circumstances, the MSG may also contain Internet transport header information within a MAPI property, which can be extremely useful when examining a message that originated from SMTP transport.
Forensic tools should therefore parse the MSG structure and expose the relevant properties rather than relying solely upon the rendered email displayed to the examiner.
Can EML or MSG Files Be Altered or Fabricated?
Yes. Neither format should be treated as inherently tamper-proof.
An EML is relatively straightforward to inspect as text and can also be edited or generated. MSG is a more complex structured format, but it can likewise be created or modified using appropriate software or libraries.
For that reason, forensic authenticity should not be based solely upon the fact that a file opens correctly in Outlook or another email client. A fabricated message can potentially be made to look convincing to a human reader.
The examiner should instead look for internal consistency and external corroboration.
How Can a Forensic Examiner Authenticate a Disputed Email?
Where fraudulent activity is alleged, the strongest analysis will often compare the disputed file with independent evidence such as:
- Exchange Online or other server-side message trace information;
- email security gateway logs;
- journaling or archive systems;
- mailbox or PST/OST evidence;
- eDiscovery exports;
- corresponding copies from the sender or recipient;
- DNS and domain configuration relevant to authentication;
- DKIM signatures and authentication results;
- attachment metadata and cryptographic hashes; and
- other emails sent through the same environment at approximately the same time.
This last point can be especially valuable. If genuine comparison messages from the same organisation contain a consistent set of transport headers, security gateway fields and formatting characteristics, while the disputed message differs materially, that discrepancy may warrant detailed investigation.
Why the Original Electronic Email Evidence Matters
Forensic investigators should ideally obtain the email in the most original and complete electronic form reasonably available. A PDF, screenshot or printout is primarily a visual representation. It normally removes much of the technical evidence needed to investigate message transmission.
Where possible, investigators should preserve the original EML, MSG, PST, mailbox export or other source evidence and calculate cryptographic hashes so that subsequent analysis can be performed on verified working copies.
The provenance of the evidence is also important. An examiner should establish who obtained the file, from which system, by what method, and whether any conversion or processing occurred before it was supplied for examination.
Does Converting MSG to EML Affect Forensic Evidence?
Converting an MSG file into EML—or an EML into MSG—can change how information is represented and may result in properties being transformed, reconstructed or omitted. A converted file should therefore not automatically be described as the original message file.
If conversion is necessary for analysis, good forensic practice is to retain the source file, document the conversion process and distinguish clearly between the source evidence and any derivative copy.
This becomes particularly important in litigation. A technical difference found in a converted file may have been introduced by the conversion process rather than being a characteristic of the original email.
Example: Investigating a Suspected Fraudulent Payment Email
Imagine that a company receives instructions apparently from a senior executive authorising a substantial payment to a new bank account. The payment is made and is subsequently alleged to have been fraudulent.
The visible message might show the executive’s correct name and email address. That alone says little about how the message originated.
A forensic examination could analyse the EML or MSG evidence to determine whether the message contains a plausible transport history, which infrastructure handled it, what authentication checks were recorded, whether the Reply-To or Return-Path differs from the visible From address, and whether the message characteristics correspond with known legitimate emails from the executive.
If Microsoft 365 or another enterprise mail platform was involved, the examiner may then compare those findings with server-side message traces, audit information and security logs. This can help distinguish between possibilities such as sender spoofing, mailbox compromise, account takeover, local fabrication and subsequent modification of evidence.
EML vs MSG: Which Is Better for Email Forensic Investigation?
There is no universal answer. EML is often particularly useful for examining the Internet message and its SMTP/MIME structure, while MSG can preserve valuable Outlook and MAPI properties. In some investigations, having both representations—and preferably access to the source mailbox or server evidence—is considerably more useful than relying on either format alone.
The critical issue is not simply the file extension. It is whether the evidence preserves the information needed to test the factual proposition being made about the email.
For example, if the central allegation is that an externally received email was fabricated, an EML containing the original transport headers may be particularly valuable. If the investigation concerns the state of an Outlook mailbox item, the additional MAPI properties in an MSG file may provide evidence that is not available from a basic EML export.
Frequently Asked Questions About EML and MSG Forensics
Is an EML file an original email?
An EML file can preserve a highly useful representation of an Internet email, including its headers, MIME structure, body and attachments. However, the .eml extension alone does not prove that the file is an original or authentic email. Its provenance and internal structure should be examined and, where possible, corroborated against independent evidence.
Is an MSG file an original email?
An MSG file can be a legitimate preserved Outlook message containing valuable MAPI properties, recipients and attachments. As with EML, the examiner should determine how the MSG was created or exported rather than assuming that the format itself establishes originality.
Can an EML file be edited?
Yes. EML files can potentially be edited or generated. This is one reason an email forensic examiner should analyse the message’s internal consistency, transport history and authentication evidence rather than relying only on its visible contents.
Can an MSG file be edited?
Yes. MSG is a more complex structured format, but appropriate software can create or modify MSG files. The fact that an MSG opens normally in Microsoft Outlook does not by itself establish authenticity.
Is EML better than MSG for proving email fraud?
Not automatically. EML may make Internet headers and SMTP/MIME evidence easier to examine, while MSG can provide valuable Outlook and MAPI properties. The best evidence will depend on the allegation and the systems involved. In a significant fraud investigation, an examiner should ideally seek the source mailbox and relevant server-side evidence in addition to individual email files.
Can a PDF or screenshot prove that an email was genuinely sent?
A PDF or screenshot can show how an email appeared to a user, but it usually provides much less technical evidence than the underlying EML, MSG or mailbox data. It may omit Received headers, authentication results, MAPI properties and other information needed to investigate whether a message was genuinely transmitted.
What should be preserved when email fraud is suspected?
Where possible, preserve the underlying EML or MSG files, relevant mailbox data, attachments, email headers, server-side message traces, audit records and email security gateway logs. The method of acquisition and subsequent handling of the evidence should also be documented.
Conclusion: EML and MSG Evidence in Email Fraud Investigations
When an email is central to an allegation of fraud, a forensic investigation should go considerably further than reading the message displayed on screen.
An examiner may need to analyse EML structure, MSG/MAPI properties, SMTP Received headers, Message-ID values, MIME boundaries, DKIM signatures, SPF and DMARC results, timestamps, attachments and server-side evidence. These elements can then be compared with known genuine messages and independent system records.
Neither an EML nor an MSG file proves authenticity simply by existing. Equally, missing metadata should not automatically be interpreted as evidence of fabrication without considering how the message was created, exported, migrated or preserved.
The purpose of a forensic email investigation is therefore to determine whether the available electronic evidence is technically consistent with the history claimed for the message and to identify anomalies that may indicate alteration, fabrication, spoofing or another form of fraudulent activity.
Where significant financial transactions, litigation or allegations of fraud depend upon disputed email communications, preserving and examining the underlying electronic messages can provide evidence that is simply unavailable from screenshots, PDFs or printed copies.
Need an Email Forensic Investigation?
Where the authenticity, transmission or content of an email is disputed, an email forensic expert can examine the underlying EML, MSG, mailbox and server evidence to determine whether the available technical evidence is consistent with the history claimed for the message.
This type of examination can be particularly relevant to fraud investigations, business email compromise, payment diversion, disputed contractual communications and litigation involving allegedly fabricated or altered emails. Preserving the original electronic evidence before conversion or further processing can materially improve the evidence available for forensic examination.