Can You Prove an Email Was Sent or Received? A Forensic Expert’s Guide

Introduction

In commercial disputes, employment tribunals, civil litigation and fraud investigations, a seemingly straightforward email forensic question frequently arises: Can you prove that an email was actually sent or received?

One party may claim that an important email was sent, while another denies ever receiving it. In other cases, an email presented as evidence may be challenged as having been fabricated, altered or incorrectly dated.

Although emails contain valuable technical information, establishing their authenticity and delivery history is not always straightforward for an email forensics expert.

An independent email forensic expert can examine message headers, Microsoft 365 records, email metadata and other digital evidence to assess whether an email was genuinely transmitted, received or potentially manipulated.

This article explains the technical email forensic evidence available and its limitations.

1. Does an Email in Sent Items Prove It Was Sent?

Finding an email in a user’s Sent Items folder is evidence that a message was saved there. However, it does not conclusively establish that the email was successfully transmitted or delivered.

For example, Microsoft Outlook and other email clients may create or retain message copies during the sending process.

Additionally, email files can potentially be imported, copied or manipulated using specialist software.

A forensic examination should therefore consider whether the message contains technical evidence consistent with normal email transmission.

Relevant indicators include:

• Message creation and submission timestamps.
• Sender and recipient information.
• Message-ID values.
• MAPI properties within Outlook MSG files.
• Available server-side submission records.
• Consistency with other messages in the mailbox.

Importantly, a message located in Sent Items will not necessarily contain the SMTP transport headers expected in a received email.

The absence of such headers, by itself, is not evidence of fabrication.

2. What Evidence Proves an Email Was Received?

A received email may contain considerably more information about its transmission history.

When an email travels between mail servers, SMTP systems normally add Received header fields documenting aspects of the message’s journey.

These headers can include:

• Sending and receiving mail server identifiers.
• IP addresses.
• Transmission timestamps.
• SMTP routing information.
• Transport security details.

For example, a message sent from Microsoft 365 to an external organisation may contain multiple Received headers documenting its movement through Microsoft’s infrastructure and the recipient’s email systems.

However, these records must be interpreted carefully.

Some header information can be forged, and a Received header does not automatically prove that a particular individual opened or read the message.

A forensic expert evaluates the consistency and reliability of the complete header chain rather than relying on individual fields.

3. Understanding the Difference Between Sending, Delivery and Reading

One of the most important distinctions in email forensic investigations is the difference between sending, delivery and reading.

Sending: The sender’s email client submits a message to an email service.

Delivery: The receiving email system accepts or delivers the message to the intended mailbox or another configured destination.

Reading: The recipient accesses or views the message.

These events are technically different and require different forms of evidence.

For example, an SMTP server response indicating successful acceptance may establish that a receiving server accepted responsibility for the message.

It does not necessarily establish that the message reached the recipient’s Inbox.

The message could subsequently be quarantined, redirected, rejected internally or processed by another security system.

Similarly, read receipts are not definitive proof that a recipient personally read and understood an email.

4. Can Microsoft 365 Message Trace Prove Delivery?

Microsoft 365 provides message-tracing capabilities that can be particularly valuable in email disputes.

Exchange Online message trace records can help establish:

• Whether a message entered Microsoft’s email infrastructure.
• Whether a message was submitted for delivery.
• The sender and recipient addresses.
• Message processing events.
• Delivery, failure or filtering outcomes.

Where available, these records provide independent server-side evidence that can corroborate information contained within an email. However, Microsoft 365 message trace data is subject to retention limits.

Standard Exchange Online message trace information is generally available for up to 90 days, although organisations may retain additional evidence through other logging, archival or compliance systems.

For historical disputes involving emails sent several years earlier, original message trace records may no longer exist.

In these circumstances, forensic examination must rely on other available evidence.

5. Can Email Headers Establish Authenticity?

Email headers are among the most valuable sources of technical evidence when investigating disputed messages.

An expert email forensic examiner may assess several indicators.

Message-ID

The Message-ID is a unique identifier intended to identify a particular email message.

Microsoft 365 commonly generates Message-ID values containing identifiers associated with its Exchange Online infrastructure.

However, Message-ID values can be generated or modified by software.

Consequently, a plausible Message-ID does not independently prove that an email was transmitted.

SPF, DKIM and DMARC

Email authentication technologies can provide additional evidence concerning message origin.

A valid DKIM signature can provide useful evidence that signed content has not changed since signing.

However, authentication results must be interpreted in context, and successful authentication does not establish that a particular individual personally authored the message.

6. Why MSG and EML Files Matter in Email Investigations

The format in which email evidence is supplied can significantly affect a forensic examination.

Two common formats are Microsoft Outlook MSG and EML.

Both formats can provide valuable evidence.

However, neither format automatically guarantees authenticity. Both formats produced together will greatly assist an email forensic expert.

For example, an MSG file exported from a sender’s Sent Items folder may contain different metadata from a corresponding message recovered from the recipient’s Inbox.

An expert must consider the source mailbox, extraction method, message format and whether the evidence represents an original or subsequently modified artefact.

7. Can Email Conversation Chains Be Fabricated?

Email conversation chains are frequently submitted as evidence in litigation.

A chain may appear to demonstrate that several individuals exchanged messages over a particular period.

However, the visible conversation displayed in Outlook is not necessarily sufficient to establish that every message was genuinely transmitted.

Email forensic experts can examine:

• Message-ID relationships.
• In-Reply-To and References headers.
• Conversation identifiers.
• Message timestamps.
• Quoted message content.
• MIME formatting.
• Differences between independently recovered message copies.

Inconsistencies may indicate that messages were edited, reconstructed or generated outside the normal email transmission process.

Nevertheless, legitimate email clients can also produce variations in conversation formatting and metadata.

An independent forensic assessment must distinguish suspicious anomalies from normal software behaviour.

8. What If the Original Email Server Logs No Longer Exist?

Many email disputes concern communications from several years earlier.

By the time litigation begins, the original SMTP transaction records may have been deleted under normal retention policies.

This does not necessarily prevent a forensic investigation.

Alternative evidence may include:

• Original MSG or EML files.
• Outlook PST or OST data.
• Recipient mailbox copies.
• Archived messages.
• Microsoft Purview eDiscovery exports.
• Email journaling records.
• Backup systems.
• Relevant endpoint forensic artefacts.

Comparing independently preserved copies of the same email can be particularly useful.

For example, a message recovered from the sender’s mailbox may be compared with a corresponding message recovered from the recipient’s mailbox.

Matching technical characteristics can provide stronger corroboration than examining a single isolated email.

9. How Is Email Evidence Authenticated in Court?

In the United States, electronic evidence may be assessed under Federal Rules of Evidence 901 and 902.

Where expert testimony is required, the reliability of forensic methodology may also be examined under Federal Rule of Evidence 702 and the Daubert framework.

In England and Wales, independent expert witnesses in civil proceedings are subject to Civil Procedure Rules Part 35 and associated practice directions.

An email forensic expert may be asked to provide an opinion concerning:

• Whether an email is consistent with genuine transmission.
• Whether its technical metadata contains anomalies.
• Whether evidence suggests subsequent modification.
• Whether independently recovered copies corroborate one another.
• What conclusions can reasonably be drawn from the available evidence.

The expert’s responsibility is to provide an objective technical assessment, clearly distinguishing established facts from interpretations and limitations.

10. When Should You Engage an Independent Email Forensic Expert?

Independent forensic examination can be particularly valuable where:

• A party denies sending or receiving an email.
• Email evidence is suspected of being fabricated.
• A disputed message forms a central part of litigation.
• Email timestamps or conversation sequences appear inconsistent.
• Only screenshots, printed emails or incomplete message copies are available.
• A court requires independent technical expert evidence.

Early engagement can also help preserve relevant evidence before additional information is lost through routine retention processes.

Conclusion

Proving that an email was sent, received or read requires more than simply producing a copy of the message.

Reliable conclusions depend on the available technical evidence, its provenance and the consistency of information recovered from independent sources.

Email headers, Microsoft 365 message traces, MAPI properties, MIME structures and conversation metadata can all contribute to an assessment.

However, no single technical indicator should automatically be treated as conclusive proof of authenticity or delivery.

An independent email forensic examination can help establish what the evidence supports, identify potential anomalies and explain the limitations of the available records.

Need an Independent Email Forensic Expert?

Global Email Forensics provides independent email forensic examinations and expert witness services for law firms, businesses and individuals involved in disputes concerning email authenticity, provenance and delivery.

Services include Microsoft 365 email investigations, MSG and EML analysis, email header examination, disputed conversation reconstruction and expert reporting for legal proceedings.

If you need to establish whether an email was genuinely sent, received or potentially manipulated, contact Rob Walton at Global Email Forensics to discuss an independent technical assessment.