Emails frequently play a crucial role in civil litigation, employment disputes, commercial disagreements, fraud investigations and criminal proceedings. They may contain contractual agreements, financial instructions, admissions, threats or communications that establish a sequence of events.

However, the existence of an email does not automatically establish its authenticity, accuracy or reliability.

Emails can be modified, fabricated, selectively presented or incorrectly attributed to an individual. Understanding how email evidence is authenticated, and what makes it reliable, is therefore essential for lawyers, investigators and organisations involved in litigation.

An independent email forensic expert witness can help determine whether disputed email evidence is technically consistent with its claimed origin and history.

1. Is Email Evidence Admissible in Court?

Email evidence is routinely used in courts throughout the United Kingdom, United States and other jurisdictions.

However, admissibility depends on the applicable legal rules and the circumstances of the case.

In the United States, Federal Rule of Evidence 901 requires sufficient evidence to support a finding that an item is what its proponent claims it to be.

Rules 902(13) and 902(14) also provide mechanisms for authenticating certain electronic records and copied electronic data through appropriate certifications.

In England and Wales, the Civil Procedure Rules govern the use of documentary evidence in civil proceedings. CPR Part 32 addresses evidence, while Practice Direction 31B provides guidance on electronic disclosure in proceedings to which it applies.

Importantly, admissibility and authenticity are not the same as reliability.

An email may be admitted into evidence while questions remain concerning its authorship, completeness or evidential weight.

2. What Makes an Email Authentic?

Email authenticity concerns whether a message genuinely represents the communication it purports to be.

A forensic examination may investigate:

• Whether the email originated from the claimed email account or system.
• Whether the sender and recipient information is technically consistent.
• Whether the message was transmitted through the claimed infrastructure.
• Whether its content or metadata shows evidence of alteration.
• Whether its timestamps and conversation history are consistent.
• Whether independent records corroborate its existence.

A displayed sender address alone is insufficient to establish authorship.

Email addresses can be spoofed, and genuine accounts can be compromised or accessed by unauthorised individuals.

Even where an email demonstrably originated from a particular account, further evidence may be required to establish who actually composed or sent it.

3. Why Email Headers Matter in Court

Email headers contain technical information describing aspects of a message’s creation, routing and processing.

Depending on the email system and the available copy, useful fields may include:

Message-ID: A message identifier generally generated by the originating email system.

Received: Headers added by participating mail servers as a message passes through the transport infrastructure.

Date: The message’s stated composition or submission date, which should be interpreted alongside other timestamps.

Authentication-Results: Records of authentication checks performed by a receiving system.

DKIM-Signature: A cryptographic signature that may allow verification of selected message headers and body content, provided the relevant verification conditions are satisfied.

An Email Forensic Expert may examine these fields collectively to identify inconsistencies and assess whether the claimed transmission history is technically plausible.

However, missing headers do not automatically indicate fabrication.

For example, an email exported from the sender’s Microsoft 365 Sent Items folder may contain fewer transport headers than the corresponding message in the recipient’s Inbox.

The origin and acquisition method of the evidence must therefore be established before drawing conclusions.

4. Are Email Screenshots and PDF Copies Reliable Evidence?

Screenshots and PDF printouts are commonly submitted as email evidence during litigation.

Although useful for presenting message content, they generally provide less technical information than native email files.

A screenshot can show:

• The apparent sender and recipient.
• A displayed date and time.
• The subject and visible message text.

It usually cannot independently establish the original transport headers, underlying mailbox properties or complete attachment structure.

Furthermore, screenshots and PDF documents can be edited using widely available software.

This does not mean that every screenshot is unreliable or inadmissible. Rather, its evidential value depends on authentication and supporting evidence.

Where authenticity is disputed, native email evidence should be obtained whenever possible.

5. MSG and EML Files: Why Native Evidence Matters

Two common formats encountered in email forensic investigations are MSG and EML.

Outlook MSG files

MSG files typically preserve Microsoft Outlook message information in a MAPI-based structure.

Depending on the source and export method, they may contain:

• Sender and recipient properties.
• Message creation and modification timestamps.
• Internet transport headers.
• Conversation identifiers.
• Message bodies and attachments.
• Other Microsoft Exchange metadata.

EML files

EML files generally preserve internet email content in a format based on MIME and internet message standards.

They may contain transport headers, multipart message bodies, attachments and encoded content.

Neither format automatically guarantees authenticity.

A forensic examiner must assess the actual contents of the files, their acquisition history and whether the available metadata is consistent with the claimed communication.

6. Can Email Timestamps Be Manipulated?

Email timestamps are frequently important in litigation, particularly where the sequence of communications is disputed.

An email may contain several different timestamps, including:

• The date recorded in its internet headers.
• The time the message was submitted.
• The time it was received.
• The creation time of the mailbox item.
• The last modification time of the message object.

These values do not necessarily represent the same event.

For example, a draft email may have been created hours before it was sent. Similarly, a message object’s modification timestamp may change during subsequent processing.

Time-zone differences and daylight saving adjustments can also complicate interpretation.

A forensic examination should compare timestamps across available sources rather than treating one timestamp as conclusive.

An unexpected timestamp is an investigative finding, not automatic proof of manipulation.

7. How Email Conversation Chains Can Be Examined

Email conversations often contain replies, forwards and quoted earlier messages.

Forensic experts can examine the Message-ID, References and In-Reply-To fields to reconstruct relationships between messages.

This can help identify:

• Missing messages within a conversation.
• Inconsistent reply relationships.
• Unexpected chronological sequences.
• Differences between quoted and original message content.
• Conflicting versions of the same communication.

However, a coherent conversation chain does not independently establish that every message was genuinely transmitted.

Quoted email text and reference identifiers can be reproduced or modified.

Where possible, the examiner should compare independent copies obtained from different participants’ mailboxes.

8. Establishing Chain of Custody and Evidence Integrity

Reliable digital evidence requires more than technically plausible email metadata.

The examiner should also establish how the evidence was collected, preserved and handled.

A defensible forensic process may include:

1. Obtaining original email files or controlled mailbox exports.
2. Documenting the source mailbox and acquisition procedure.
3. Calculating SHA-256 cryptographic hashes.
4. Preserving original evidence without unnecessary modification.
5. Maintaining an examination record.
6. Documenting any limitations affecting the findings.

Cryptographic hashes can demonstrate that a particular file has remained unchanged since it was hashed.

However, a matching hash does not establish that the file was authentic before collection.

This distinction is especially important where the original evidence source is disputed.

9. The Role of an Independent Email Forensic Expert Witness

When email authenticity is challenged, an independent forensic email expert can provide technical findings to assist the court.

An examination may involve Microsoft 365 or Exchange Online records, native MSG and EML files, message headers, attachments, conversation metadata and evidence obtained from relevant devices.

The resulting report should distinguish between:

Established findings: Facts supported by the available technical evidence.

Consistency indicators: Features that support a particular explanation without independently proving it.

Limitations: Questions that cannot be resolved from the material supplied.

In England and Wales, expert evidence in civil proceedings is governed by CPR Part 35. In US federal proceedings, expert testimony is subject to applicable evidential requirements, including Federal Rule of Evidence 702.

An independent expert’s responsibility is to provide objective, technically supported opinions rather than advocate for a particular party.

10. What Should Lawyers Do When Email Authenticity Is Disputed?

Where an email is central to litigation, early preservation is important.

Lawyers should consider requesting native message files, relevant mailbox records, original attachments and information about how the evidence was obtained.

Where appropriate and legally available, independent copies from recipients, preserved audit records and historical message-tracking information may provide additional corroboration.

It is also important to avoid unnecessarily opening, modifying or resaving original evidence before forensic preservation.

The earlier an expert becomes involved, the greater the opportunity to identify relevant evidence before it is deleted or becomes unavailable.

Conclusion: Reliable Email Evidence Requires Technical Verification

Forensic email evidence can be highly persuasive in court, but its apparent contents should not be confused with proof of authenticity.

A reliable forensic expert assessment considers message headers, metadata, timestamps, conversation relationships, file integrity and the circumstances in which the evidence was obtained.

No single header, timestamp or file property should ordinarily determine an email’s authenticity in isolation.

Where email evidence is disputed, independent forensic examination can help lawyers understand what the available records establish, what remains uncertain and whether further evidence is required.

Need an Independent Email Forensic Expert?

Global Email Forensics provides independent email authenticity examinations, technical investigations and expert witness reporting for legal professionals and organisations.

Services include examination of disputed emails, Microsoft 365 and Exchange Online evidence, MSG and EML analysis, email header investigations and forensic reporting for litigation.

If you are involved in a dispute concerning email authenticity, alteration, authorship or delivery, contact Global Email Forensics to discuss an independent technical assessment.