Skip to content
Skip to main content
Email Evidence Technical Explainer

What information may disappear if the message is forwarded or exported incorrectly?

An email can retain its visible words while losing routing, authentication, MIME and mailbox context. A readable derivative is not necessarily a complete copy of the message that arrived.

Each conversion can flatten or replace evidence

An inline forward creates a new header, Message-ID, timestamps and route around quoted content. It can omit the original Received chain, Authentication-Results, Return-Path and provider identifiers. PDF, print and screenshots preserve appearance rather than hidden HTML, link destinations or message structure.

Attachments may be omitted, renamed, re-encoded, recompressed or replaced by cloud links. Plain-text and HTML alternatives, inline Content-ID relationships, embedded messages and exact time-zone offsets can disappear.

Preserve source first and derivatives second

Keep the original in its mailbox and acquire native EML, MSG or suitable mailbox material with complete raw source. Record folder and acquisition method and retain attachments in their original relationship. Create readable copies for presentation without replacing the source.

If only a forward or image remains, preserve it as such and seek another mailbox, archive, provider or sender copy. Report the specific limits rather than rejecting all evidential value.

The point to remember

Forwarding and presentation exports may preserve appearance while discarding the technical structure needed for route, integrity and attribution.

Sources

Reference: EML-029Email Evidence