Investigation pathway
I have been given a suspicious email
Use this route to preserve the original material, identify account and delivery questions and avoid assuming that the visible sender wrote or sent the message.
3 practical steps
Orientate
Establish what the email may contribute
Start with the investigative purpose, the form of the material and the immediate preservation risk.
Open EML-014 Interpret account use
Consider shared or delegated mailbox access
Separate the mailbox, visible sender and person who may have used delegated permissions.
Open EML-023 Preserve
Use the email preservation checklist
Retain the original message, attachments, headers, mailbox context and relevant provider-held records.
Open EML-043 Pathway outcome
Browse email evidence Preserve first, then test the sender claim
The visible message is one part of the enquiry. Account access, delivery infrastructure, mailbox records and corroboration may all matter.
