An email is more than the text shown on screen. Technical headers, routing information, attachments, account logs, mailbox rules and surrounding correspondence can help establish where a message came from and how it fits into a wider event.
Preserve the original message
Forwarding or copying an email into a document can strip technical data. Where possible, preserve the original message in its native mailbox or exported message format together with full headers.
Headers add technical context
Headers can include routing servers, message identifiers, authentication results and timestamps. They do not answer every question, but they can help distinguish spoofing, forwarding and genuine mailbox activity.
Mailbox activity can be relevant
Sign-in history, deleted items, forwarding rules and sent-mail activity can matter in account-compromise or business-email investigations. Preserve these records before retention periods expire.
Compare content with external evidence
Invoices, bank-detail changes, supplier records, call logs and internal communications can confirm or challenge what the email appears to show.
- Original emails and attachments
- Full headers
- Mailbox audit and sign-in logs
- Forwarding and inbox rules
- Related invoices or documents
- Known genuine emails for comparison
- Relying only on a screenshot of the email body
- Deleting suspicious rules before documenting them
- Assuming the visible From address proves authorship
- Forwarding evidence repeatedly between accounts