What information may disappear if the message is forwarded or exported incorrectly?¶
title: What information may disappear if the message is forwarded or exported incorrectly? subtitle: A message can still look complete after important technical structure and context have been stripped away. slug: what-information-may-disappear-if-forwarded-or-exported-incorrectly series: email-evidence section: first-actions card_type: question_card pathway_order: 6 section_order: 5 status: draft public_safe: true video_ready: true word_count: 584 estimated_read_time_seconds: 242 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - forwarding - export - headers - MIME sources: - title: 'RFC 5322: Internet Message Format' url: https://www.rfc-editor.org/info/rfc5322/ - title: 'Gmail Help: Download and send emails as attachments' url: https://support.google.com/mail/answer/9261412?hl=en-GB - title: 'Microsoft Support: Save an Outlook message as an EML file, PDF file, or draft' url: https://support.microsoft.com/en-us/outlook/mail/save-an-outlook-message-as-a-eml-file-a-pdf-file-or-as-a-draft - title: 'Gmail Help: Trace an email with its full header' url: https://support.google.com/mail/answer/29436?hl=en-GB
What information may disappear if the message is forwarded or exported incorrectly?¶
A message can still look complete after important technical structure and context have been stripped away.
Script¶
An email can look perfectly normal after it has been forwarded, printed or exported into the wrong format.
That doesn’t mean all of the original information survived.
An ordinary forward creates a new message.
The new message has its own header, timestamps, sender, recipients, Message-ID and delivery route. The original may be reduced to quoted text inside the body.
The person receiving the forward may see the original sender name, subject and content, but the full original header may be missing.
That can remove or obscure:
the Received chain;
authentication results;
the original Message-ID;
the envelope return address;
provider-specific tracking fields;
the exact sending and delivery times;
the timezone;
and identifiers that could link the message to server-side logs.
The body can change as well.
Email commonly contains plain-text and HTML versions. A forward may include one rendered version rather than the complete MIME structure.
Formatting can be rewritten. Remote images may be replaced or omitted. Hidden HTML may disappear. Links may be shortened, rewritten or displayed only as friendly text.
An address that appears as “View document” on screen may point somewhere very different underneath. A screenshot or PDF may capture the words but not the destination.
Attachments can also change.
They may be omitted, renamed, recompressed, re-encoded or replaced by cloud-sharing links. Embedded messages may be flattened into text. File timestamps and other properties may change when the attachment is downloaded and resaved.
A printed or PDF copy usually preserves appearance, not behaviour or structure.
It may omit full headers, attachment content, interactive elements, underlying links, alternative body versions and the relationship between MIME parts.
Even a copied header can lose information if line breaks, whitespace, duplicated fields or unusual characters are altered.
Mailbox context can disappear too.
A single exported message may not show which folder held it, whether it belonged to a conversation, whether the recipient replied, whether it was marked as spam, whether it was moved by a rule or whether related messages were deleted.
Some information was never present in the delivered message in the first place.
For example, the recipient’s copy may not contain every original envelope recipient. BCC information is normally hidden from other recipients. Provider logs or the sender’s Sent item may be needed to understand wider delivery.
The practical answer is to preserve in layers.
Keep the original in the mailbox.
Acquire a native EML, MSG or appropriate mailbox export.
Preserve the complete raw source.
Keep attachments in their original relationship to the message.
Record the mailbox, folder and acquisition method.
Then create screenshots, PDFs or readable copies for convenience if needed.
Those derivative copies can be very useful. They simply shouldn’t replace the source.
A forward-as-attachment option may retain the original message object more effectively than an inline forward. But check what the system actually created and preserve the original mailbox copy as well.
The common mistake is to say, “Nothing was lost because all the words are still there.”
The words may be enough for some questions.
They may not be enough to establish how the email travelled, which domain authenticated it, which service generated it, whether an attachment was the same file or which provider record matches it.
When the only available item is a forward, screenshot or PDF, don’t discard it.
Record what it is, preserve it, and search for a better source from another recipient, an archive, the sender’s system or the email provider.
Forwarding preserves a version of the story.
Proper acquisition preserves the message that actually arrived.
Key takeaway
Forwarding preserves what someone chose to pass on. Native acquisition preserves the message that was actually received.
Related questions¶
- How do I preserve an email properly?
- Is a screenshot or forwarded copy enough?
- Should I preserve the mailbox as well as the individual message?
Source notes¶
- RFC 5322: Internet Message Format
- Gmail Help: Download and send emails as attachments
- Microsoft Support: Save an Outlook message as an EML file, PDF file, or draft
- Gmail Help: Trace an email with its full header