Skip to content
EML-010 Email Evidence

How do I preserve an email properly?

title: How do I preserve an email properly? subtitle: Keep the message in its original environment and acquire a native copy that retains the full source. slug: how-do-i-preserve-an-email-properly series: email-evidence section: first-actions card_type: question_card pathway_order: 2 section_order: 1 status: draft public_safe: true video_ready: true word_count: 628 estimated_read_time_seconds: 260 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - preservation - EML - MSG - headers sources: - title: 'RFC 5322: Internet Message Format' url: https://www.rfc-editor.org/info/rfc5322/ - title: 'Gmail Help: Trace an email with its full header' url: https://support.google.com/mail/answer/29436?hl=en-GB - title: 'Gmail Help: Download and send emails as attachments' url: https://support.google.com/mail/answer/9261412?hl=en-GB - title: 'Microsoft Support: Save an Outlook message as an EML file, PDF file, or draft' url: https://support.microsoft.com/en-us/outlook/mail/save-an-outlook-message-as-a-eml-file-a-pdf-file-or-as-a-draft - title: 'Microsoft Support: View internet message headers in Outlook' url: https://support.microsoft.com/en-us/outlook/view-internet-message-headers-in-outlook

How do I preserve an email properly?

Keep the message in its original environment and acquire a native copy that retains the full source.

Script

Preserving an email properly means keeping more than the words visible on the screen.

The safest starting point is to leave the original message in its original mailbox and obtain a native copy that retains the complete message source.

Depending on the email system, that may be an EML file, an MSG file, a mailbox export or an acquisition carried out through an organisational or forensic process.

The format matters less than the outcome.

You want a copy that preserves the full header, body, attachments, embedded content and message structure. You also want enough context to explain where it came from, who acquired it and how.

Start by identifying the original mailbox.

Was the email received through Gmail, Microsoft 365, an on-premises server, a webmail service, a mobile application or another system? Is it still available in the recipient’s Inbox, Junk folder, Deleted Items, archive or another folder?

Record the account, folder and date and time you found it. Preserve the conversation or surrounding messages where they help explain the context.

Then export or download the original message using a method supported by that platform.

In Gmail, viewing “Show original” exposes the full message source, and downloading the message can create an EML file.

In Outlook and Microsoft 365, the available method may produce an EML or MSG file depending on the version and client.

A PDF, screenshot or printed copy can be useful for reading and presentation, but it isn’t the preferred preservation format. Those formats reproduce what the user saw. They don’t necessarily preserve the message as an email object.

Keep the native file unchanged.

Don’t open and resave it through several applications if that can be avoided. Don’t rename attachments inside the message, rewrite the subject or copy the body into a new document and call that the original.

If your organisation uses hashes, evidence bags, case exhibits or another integrity process, apply the local procedure to the acquired file and record who handled it.

Preserve the whole message, including parts that seem unimportant.

That includes:

the full raw header;

the plain-text and HTML bodies;

attachments;

embedded or remotely loaded images;

calendar items or other MIME parts;

the original filenames;

the visible and underlying link destinations;

and any provider-specific identifiers.

Don’t click suspicious links or open attachments merely to see what they contain. Preserve them first and use the appropriate safe examination process.

Also remember that the message file and the mailbox are different sources.

The message contains what travelled with that email.

The mailbox or provider may separately hold message-trace records, account audit logs, delivery events, access records, rules, deleted items and related messages. If those may matter, preserve or request them as well.

The most common mistake is to treat a screenshot as preservation because it looks complete.

It may show the sender, recipient, subject and body. It may miss the complete header, exact link, hidden HTML, attachment structure, Message-ID, delivery path and authentication results.

Another mistake is to forward the email to the investigator and delete the original. That creates a new message around an incomplete copy and may remove the best source.

A simple preservation record should answer:

Which mailbox held the email?

Where in the mailbox was it found?

Who acquired it?

When and how was it acquired?

Which file or export was created?

Was the original left in place?

Were attachments and related messages preserved?

Were any protective or containment actions taken?

You don’t need to understand every header field before preserving the email.

Preservation comes first precisely because later analysis may show that a field, attachment or provider identifier matters.

Keep the original where it is. Acquire a complete native copy. Record what you did. Then analyse a working copy rather than repeatedly handling the only preserved version.

Key takeaway

Preserve the original message, not just its appearance. The header, MIME structure, attachments and mailbox context may all matter.

Source notes

Keep moving

Where this question leads

These links explain why the next page may matter, rather than presenting an undifferentiated list.