Why might the plain-text and HTML versions differ?¶
Plain-text and HTML bodies are separate MIME parts that a mail client can render differently. Differences may result from ordinary message generation, but they can also change the wording, destination or action presented to the recipient.
Alternative parts are not guaranteed to match¶
A multipart/alternative message commonly contains text/plain and text/html versions. The client selects a part according to its capabilities, settings and security policy. Formatting, tables, images and buttons may disappear from plain text, while an HTML label can conceal the full URL behind it.
Legitimate systems may generate one part automatically or update one template without updating the other. Security products can also rewrite links or transform content. A difference alone is therefore not evidence of malicious intent.
However, one part may contain different instructions, telephone numbers, payment details or destinations. HTML styling can hide text, and an image can present words that are absent from searchable content. A gateway, search tool and recipient's client may each expose a different representation.
Compare the parts and the rendered view¶
Preserve the complete raw message before decoding a working copy. Identify each MIME part, its character set and transfer encoding, then compare meaningful content: names, dates, amounts, instructions, attachment references, displayed text and underlying links.
Record the device and application used by the recipient. The raw structure shows what alternatives existed; client settings, screenshots and witness evidence help establish what was actually displayed. Do not assume that the last-listed part was shown to every recipient.
Keep original encoded parts as well as readable renderings made for examination. If a security service rewrote a URL, distinguish the version as delivered, the destination recovered through supported records and any later exported copy.
Key takeaway
Treat plain-text and HTML bodies as related but separate evidence: preserve both, compare material differences and establish which representation the recipient actually saw.
