Recording and technical examination of email
We examine emails together with technical information and attachments. We help distinguish the on-screen display from the original message data and mail infrastructure.
Discuss the materials required ↗When it is needed
The task is relevant in disputes over sending documents, agreeing terms, attachment contents or changes to an email's content. Before examination, we clarify whether it requires mailbox inspection, analysis of saved messages or comparison of materials held by sender and recipient.
What we record and examine
- Original EML and MSG messages and other agreed formats.
- Full technical headers, available routing information and message identifiers.
- Text, MIME structure, attachments and their technical characteristics.
- Screenshots, printouts, available mail server logs and domain authentication check results.
What to prepare
- Original emails with full headers; a forwarded copy does not always preserve all original data.
- Attachments as received and an explanation of which email they came from.
- Mailbox addresses, required period and list of disputed messages.
- Where available, server logs, delivery notifications and materials from the other party.
Sample questions
- Which sender, recipient and identifiers are specified in the original email messages?
- What information about transmission of the email message is available in its full technical headers?
- Are the Date field and available mail server timestamps consistent?
- Do the email attachments match across the packages provided by the parties?
- Are the email data sufficient to conclude that a particular message was delivered, and what are the limitations of that conclusion?
How the work proceeds
We compare email content, technical fields and attachments. Timestamps are considered with regard to time zones and the origin of each field. Where server data are available, we check their relationship to the original message. Observed SPF, DKIM and other verification results are assessed in the context of the available package, without treating them as establishing the sender's identity.
What to bear in mind
A date in the interface or Date field does not by itself establish actual delivery time. An address in the From field does not establish the user's identity. Technical email checks do not guarantee a conclusion that the recipient personally read the message; the legal significance of notice is assessed separately.
How to preserve source data
Use your email client's option to save the original message or view its full source. Save an unedited copy; do not rely solely on forwarding the email to another address. Do not provide the entire mailbox, password or unrelated emails unless required by the agreed assignment.
Result and fee
Depending on the assignment, we prepare a technical inspection record, a description of the saved package or a specialist opinion with examination and conclusions. The result identifies the objects, working conditions, methods used and limitations.
We agree on the fee after determining the number of sources, period, volume of messages and attachments, need for device inspection and questions. An initial call of up to 15 minutes is free.
Frequently asked questions
Can we start with a PDF or printout?
Yes, for an initial discussion. However, PDFs usually lack the full technical data needed to examine transmission routing and the original message structure.
Does an email prove it was read?
Not automatically. Delivery, display in a mailbox and personal reading are different facts. The conclusion depends on the technical data and questions raised.
Do you issue a notarial record?
A notary prepares a notarial record. A technical specialist can examine emails and prepare their own findings, and help identify materials for a notarial inspection.
Other digital materials
Tell us
about your task.
Describe the situation and attach the materials. After reviewing your request, we will agree on the examination format, questions, timeframe and cost.