In any court case involving expert witness testimony, sticking to the evidence is an area of critical importance.
The expert witness is there to guide the court based on their experience. No one else in the court, apart from any other expert witness, is able to provide the same level of knowledge. The court primarily expects guidance based on the facts presented. An expert witness may be tempted to speculate based on their experiences in the area of email messaging systems, but this must be resisted, unless they are specifically asked.
The email expert witness is expected by the court to be unbiased. Any speculation provided, if not requested, may be perceived as moving away from impartiality, and therefore being biased. Any testimony provided by an email expert witness who is perceived to be biased will carry less weight with the court. The Ikarian Reefer principles are a relevant reference for this.
A leading email expert witness will be concise with their testimony, ensuring factual evidence is referenced. Speculation should be resisted, unless asked specifically. This simple rule can be crucial in the outcome of any email forensics court case, especially if the opposing email expert witness is seen as being biased by the court – weakening their authority and credibility.
Contact Rob Walton if you need an experienced email expert witness to help you with your email forensics requirements. Return to the home page of Global Email Forensics for further details.
This blog post covers some of the common terminology used when working as an smtp expert witness in court cases involving email forensics.
Deposition
A legal term referring to the out-of-court testimony of a witness or party in a lawsuit, given under oath and recorded by a court reporter. A deposition is a crucial part of the discovery process, allowing attorneys to gather information, assess witness credibility, and prepare for trial. This is usually orally based.
Artefact
A factual piece of information that can be used as part of a Deposition or Briefing Report. An smtp expert witness relies on artefacts to help form an opinion on a court case.
Briefing Report
Information for the expert to form an informed opinion and effectively communicate it in legal proceedings. A briefing report outlines the case facts, relevant documents, and specific questions the email expert witness needs to address, ensuring they are prepared to offer objective and impartial testimony.
Authentication
Any evidence presented will have a level of authenticity. Does the evidence, or view, have high authenticity – is it beyond any refute, or can it be questioned. Any email expert witness should be aiming for presenting information with a high level of authentication.
Daubert Standard
A US Federal law standard used to determine the admissibility of any expert witness testimony, based on a set list of controls. An email expert witness will be placed under scrutiny by the Daubert Standard.
Discovery
The pre-trial phase where evidence is sought, via logs, reports, or other methods. The discovery process used will be a proven methodology that maintains a high standard of email forensic analysis.
Spoilation
Email evidence may have been deleted or tampered with. An expert witness in an SMTP matter may determine that emails, or log files, may have been removed. The expert may be able to recover such evidence that has been subject to spoilation.
Material Fact
Evidence presented that is beyond reasonable refute. Key to any judgement being made in a court case, or legal proceeding. An email expert witness will be focused on presenting only material facts in any court briefing, deposition, or testimony.
In UK law the Ikarian Reefer landmark case is commonly used to refer to the expected roles and responsibilities of an expert witness. It involved a shipping related court case in 1993.
As an expert witness in email litigation, I ensure that these guidelines are followed. If an expert witness does not adhere to these expectations, then their expert witness role may be called into question, leading to their evidence being excluded from the court case.
An expert witness is required to be impartial, objective, and independent. They are there to serve the court.
The key principles of Ikarian Reefer are:
Independence: Experts must be truly independent and not influenced by the instructing party or the pressures of litigation.
Impartiality: Expert opinions should be unbiased and based solely on their expertise, without being swayed by the party instructing them.
Objectivity: Experts must provide objective, factual, and unbiased opinions, avoiding any bias or advocacy.
Expertise: Experts should clearly state when a question falls outside their expertise and if they lack sufficient data to form an opinion.
Duty to the Court: The primary duty of an expert witness is to assist the court, not the instructing party, by providing objective and unbiased evidence.
Disclosure: If an expert changes their view after exchanging reports, they must promptly inform the other party and the court of the change.
Full Disclosure of Facts: Experts must state the facts or assumptions on which their opinion is based and acknowledge any facts that could detract from their conclusion.
When reading all of the principles, it becomes clear how an expert witness can negatively effect the outcome of the court case if they do not follow them.
The expert witness is there to serve the court. Finding the balance of representing one side of the court case, whilst adhering to the principles above is critically important. The expert witness role is not to present arguments, only facts or views based on experience. The expert witness will be paid fees from one side of any court case, however, they must primarily represent the court.
The Ikarian Reefer principles do not apply in law outside the United Kingdom, but generally are accurate for an expert witness in any country. As an example, a Canadian article refers to a court case where it was quoted.
The article linked here contains a more detailed analysis of the role of an expert witness. Included are examples of court cases where the Judge has called out a flawed expert witness, who has operated outside at least one of the Ikaar Reefer principles.
The role of an expert witness in court cases can have a strong influence on the outcome. This blog article covers some examples of court cases where the expert witness has had a critical influence on the outcome. Good or bad.
The Governors and Company of the Bank of Ireland and another v Watts Group PLC [2017] EWHC 1667 (TCC).
In this case, one of the expert witnesses was found to be not truly independent, as had worked for the Bank of Ireland on multiple occasions. They had also not entered into pre-hearing consultants fairly, and had misled the court.
Any organisation using an expert witness is advised to not use the same expert witness over a long period of time, but to use different people.
The articles below covers the court case in more detail.
Introduction: Email Forensic Experts in Court Cases
Working as an email forensics expert, I have reviewed many court cases where digital evidence was required. Digital email forensic evidence in court is often related to emails that were sent or received.
Email Witness: Waymo vs Uber | Expert Email Analysis
For this court case, a former Google engineer who worked for Uber, was accused of downloading confidential files and emails from Waymo. Waymo was a company that provided autonomous driving technology.
Uber settled the court case with Waymo in this court case. An email forensics expert would have been involved in this case.
Email Witness: COMMONWEALTH vs. Duncan PURDY | Digital Evidence
For this court case, emails were admitted as evidence, but then later dismissed. The emails were not sent from an email system that could be examined for authenticity. An email forensics expert was likely involved in this outcome.
This court case demonstrates the importance of an email forensics expert, and being able to prove the authenticity of any emails admitted as evidence. If the emails in this case were used as evidence, then the outcome may have been different.
Forensic Emails | The murder of Capt. Marty Theer
For this court case, email evidence was used alongside other digital email forensics, and formed a key part of the court case action.
Forensics in Court | Zimbabwe Opposition Party Court Case – Death Penalty
This court case in Zimbabwe would have resulted in the death penalty for an opposition leader. The case was dismissed after the prosecution could not prove an email was sent. For this case an email forensics expert would have been involved on both sides.
Email evidence can be crucial for a court case, but it must be authenticated. Contact Us today if you need email forensics expert services for any court case where email evidence is crucial.
Our consulting services are available to help you when you need an email expert for your witness requirements.
Credible Expert Witness for Email Evidence in Court
For any email SMTP expert witness in 2026 you are looking to hire, you need to ensure that person is credible, and can stand up to cross examination.
If the expert witness loses credibility in court, then it makes it very difficult for that legal team to win their court case. Especially if the other side of the legal case have an expert on their side who has higher credibility.
List of five key expert witness considerations:
How much experience does the expert witness have in email systems?
Does any opposing expert witness have less experience?
Can the email expert witness speak well in court and create a favorable impression with the Judge?
Can the expert witness withstand rigorous cross-examination by the Judge and the opposing legal team?
Does the expert witness have strong writing skills to put together a detailed report on any evidence?
Any court witness should be able to show a long work history in the field of SMTP, and email systems. They should have up to date work experience, as email technology is in constant change, with the adoption of cloud computing platforms such as Microsoft Office 365.
An expert who has 30 years experience in email information systems will have significantly more credibility than a witness who has 5 years experience. If the court case is about cloud email platforms then any experience should also cover this more recent technology.
Experience in email systems must be clearly described in an expert witness CV.
Articulate Witness Expertise in Court
The expert witness should be able to clearly articulate themselves in the court room in a clear and concise manner, and remain calm at all times. The opposing legal team will prioritize trying to make your expert witness lose credibility.
Your email SMTP expert witness should present in court physically, and not via a video link. Not appearing in person is a major disadvantage compared to an expert who can present in court.
I recently was a witness in a court case concerning digital email evidence expertise, and was present in court throughout. The opposing side had an expert witness who appeared over a remote Zoom call. This did not go well, as the audio volume was very low on the Zoom call, and the witness could not hear the court very well. All of this created an initial bad impression that could not be recovered from by that legal team.
The remote expert witness then struggled with a few answers. This meant the opposing side lost credibility. The Judge became frustrated with the poor communications link to the remote based expert witness.
Witness Skills | Analyze Evidence
During any legal action written submissions will be required prior to a court case. An email expert witness will be required to review evidence and produce a report on their findings for any questions. Often each witness can see the other’s report prior to court, and can respond on the opposing report.
An important skill is the ability to find holes in the opposing side’s expert witness report. And linking any arguments to actual evidence, or lack of evidence. The Judge will review the witness reports, and will pickup any arguments not backed up by evidence.
Conclusions from an expert witness report must be backed up by evidence. If no evidence is available a conclusion can still be made, but it must be made clear that is based on the experience of the witness.
Often a court case will come down to a few contentious points. An expert witness is there to help the court narrow down any arguments to as few as possible. This helps the Judge to summarize the case, and make a Judgement. Or to pass to the Jury for an outcome.
Impartial Expert Testimony
The court is looking to any expert witness for a case involving email evidence to be impartial. The expert is expected to talk to the evidence presented and to not go beyond their brief. If the expert witness spends time trying to convince a Judge or Jury to form a viewpoint too strongly, then they lose credibility.
The expert’s role is to stick to the evidence, and not to appear to be on any side too strongly beyond what evidence artefacts are presented. They need to gain the trust of the Court to answer questions only.
The expert’s role is to make conclusions on the evidence presented. They can do this by providing reference artefacts, and drawing on their own experience.
If any expert called upon to be a witness cannot answer a question, they are best to say they do not know the answer. Or if the question is not directly in their remit, they can say no comment, and check with the Judge if that is agreeable. The Judge may direct the expert to provide an answer if required.
Summary | Credibility Counts for a Witness in Court
Rob Walton has more experience than most people globally in email systems, having used nearly all the common email platforms from 1995 to 2026. This makes Rob Walton a very credible expert witness, a major advantage in court.
Email Forensic Investigation Evidence: Log Retention used by a Witness
For any successful email forensic investigation, the availability of email logs is a key requirement. Email messages are sent using the Simple Mail Transfer Protocol (SMTP), defined here. This blog post describes the importance of retaining the SMTP delivery logs so they can be used as part of any email forensic investigation.
SMTP Protocol for Email Delivery
As an email is sent and delivered to the recipient, the email will pass through multiple mail gateways. These gateways are also known as Message Transfer Agents (MTAs). An MTA will belong to an email system, and will be a key area of focus during the forensic investigation of an email.
The MTA’s belonging to your email system will usually have email log files available for examination. These log files may only be stored for a limited period of time, for example 90 days. Effort is required to ensure email message logs within your email system are retained for a much longer period, for example 7 years. This can be achieved in different ways, such as a scheduled task that copies them to a secure location. Or via an email server backup job. A thorough email forensic investigation can be undertaken with all available SMTP protocol log files.
Retaining the email message transport log files is crucial to the success of any email forensic investigation. This provides immutable evidence of the path an email message takes between email systems. The SMTP protocol ensures the email message header is stamped with meta-data as it moves between the sender’s mailbox, and the recipient’s mailbox. This SMTP header data cannot be removed, it can only be added to.
Email Evidence: Terms and Definitions
The term “email” is an acronym for “electronic mail”. Both terms may be used within this report, especially during an investigation.
The term email is listed in the Oxford English Dictionary as both a noun and a verb. This is important for understanding email forensic investigation terminology.
Email (noun): A system for sending textual messages (with or without attached files) to one or more recipients via a computer network (esp. the internet); a message or messages sent using this system. Also: an email address.
Email (verb): transitive. To send (a message or file) by email; to send an email to (a person, organization, etc.). Many forensic investigators focus on these email details.
Email Forensic Investigation | Delivery Example Used by a Witness
This diagram shows a conceptual diagram of a typical email delivery from one email system to another. Email delivery is a key aspect of any Office 365 email migration project – see office365migrate.com to hire an email migration expert.
The email passes through Mail Servers at each end, and is encrypted when going across the internet. This disallows any manipulation of the email. If the email logs are available from both the sender’s email system and the receiver’s email system, then a complete picture can be presented of the email delivery. This proves it was sent and received as part of the email, and is a valid conclusion of an email forensic investigation.
There are a series of Mail Servers that belong to any sending email information system. The sent email message will traverse through this prior to routing over the public internet to the receiving information system belonging to the recipient.
Multiple Mail Servers | Mail Delivery
Multiple Mail Servers may also be present within a receiving information system. All Mail Servers may require reviewing as part of an email forensic investigation. Logs from these servers are crucial for a successful email forensic investigation.
Summary: Importance of Log Retention for Email Evidence in Court
Deleted Item Retention: Forensic Email Evidence in Court
Expert witness work for digital email forensics is often concerned with the recovery of deleted emails. A person may send an email, and then delete the email from their Sent Items, and also from their Deleted Items. And then claim they never sent the email. Being able to forensically prove email delivery can be key expert evidence in a court case – see court case examples here.
It is possible to investigate this further to prove that the email was sent by that person. Many email systems store an email that has been deleted, allowing for the recovery of deleted emails. In Google GSuite, for example, deleted emails are kept in the Archive for a long time, or until the Archive is full. A typical user may not be aware of this.
Microsoft Office Exchange Online also has a “soft delete” and “hard delete” option for emails – similar to Google GSuite. Depending on the M365 license being used, there may be access to additional logging information within the Compliance Audit logs.
Recover a Deleted Email from a Journal
Larger email systems may have a Journal feature whereby copies of every email sent or received are placed into a separate Journal storage area. Examples of a Journal system might be in the Barracuda or MIMECast boundary email systems. Recovery of deleted emails from a Journal is often crucial.
A user may claim that someone else sent the email from their account. This can be investigated further in conjunction with user sign-in logs, and audit logs. It is often possible to demonstrate the device name and IP address used when the user was sending the email – which could be matched to the commonly used device name and IP address.
Gather Expert Email Evidence Artefacts
By gathering evidence, there comes a point where the weight of that evidence passes the “beyond reasonable doubt” test.
Summary | Importance of Recovering Deleted Email Sent Items
A person may try and prevent a sent email from being seen by deleting it. However, there are various ways that allow for recovery of deleted emails. This can be used as evidence in a court case where an email expert witness is demonstrating that an email was sent by a person.
Having the best email expert in a court case can make a significant difference to the outcome. There are many computing experts out there, but for a court case involving email, you will need a true SMTP specialist.
Court Expert Witness | SMTP
Rob Walton provides SMTP email witness expertise, where email delivery proof is required. Email delivery leaves behind a trail of immutable email delivery logging artefacts, which leads to the evidence being subjected to careful examination by an expert. Witness brief’s are required as part of any court case.
Being an expert witness, it is crucial to remain impartial, as this adds credibility.
Email delivery expert witness services will require extensive knowledge of email systems, and email delivery. An expert is called by either the defense or the prosecution. To be effective, the expert must have comprehensive technical knowledge.
An expert is required to take the stand in court and to withstand questioning from the Judge, or a lawyer or barrister.
Selecting a Qualified Witness for Court Case
If you have a court case where you need a witness to provide expert testimony on provided digital evidence, then you need to select carefully. There are many people and companies offering witness services. It is likely that both sides of the court case will have their own expert witness.
The Judge and Jury will quickly form an opinion on which expert has the most experience, and will give their views more weight on any disputed areas. Therefore, choosing the right SMTP expert is essential for your case.
Summary | Hiring an Email Expert Witness for your SMTP court case
Contact Rob Walton today for a confidential discussion of your expert witness requirements.
If you need an email migration expert to help you migrate to Office 365, then we recommend the team at office365migrate.com, however for an email security expert to review your email system, we recommend emailsecurityexpert.com.
Review SMTP Message Header as for Email Delivery Proof
Email delivery proof can be found by examining the SMTP headers. The SMTP protocol has been around for a long time, and provides the ability for an email fraud expert to trace the delivery path taken from the sender to the recipient.
This can be within the same email system, or between email systems. Understanding the SMTP headers can provide email delivery evidence necessary in many investigations. For instance, these headers are crucial in any analysis related to establishing provenance of email delivery.
Email Delivery Provenance Markers
There are additional markers that can be combined to provide additional evidence of a successful email delivery. These markers can all help in any email expert witness help needed for any legal action.
These markers form the basis for proof of email delivery in court.
Example SMTP Delivery Markers
Examples of markers may be read receipt, transport headers, delivery receipt, and message logs. Sometimes there is access to limited email delivery information. Expert analysis is then needed to provide an immutable picture of the email delivery path. These examples serve as email delivery proof in various scenarios, particularly when seeking comprehensive email delivery evidence.
See the blog post on the Mail Server roles for more details on the SMTP delivery path as digital evidence. Such detailed knowledge can aid in proving email delivery and establishing strong email delivery proof.
If you need help migrating your email to Office 365 then we recommend contacting office365migrate.com. For an email security expert to review your email system security, we recommend using emailsecurityexperts.com.
