Email Expert Witnesses for Disputed and Fabricated Messages

An email dispute usually arrives as a printout, a PDF or a forwarded copy, and each of those formats keeps some of the record and discards the rest. The question counsel actually needs answered is not what the page says but whether the message existed in that form, when it was sent, whether an attachment changed along the way and whether it ever reached the account on the other end. Those are separate questions with separate evidence, and we take them one at a time.

Our email practice has collected thousands of mailboxes and supported hundreds of email related deposition and testimony engagements, within a firm that has served AmLaw 100 firms and Fortune 1000 companies since 1992 and whose examiners have testified in federal and state courts. That experience is why we start every engagement by defining the disputed proposition and then hunting for the native records that can confirm or defeat it, because a convincing page can still fail the moment the underlying file is opened.

If the email in your matter exists only as a printout or a PDF today, describe what you hold to a senior examiner before the native files are requested, so the request names the records that can actually test the page.

We test alteration, timing, delivery and attachment consistency as separate propositions, because they fail in different ways. A displayed time that disagrees between two copies may be a time zone setting rather than an edit. Two printouts that agree with each other may both descend from the same altered source and corroborate nothing. A message that reached a server may never have been opened by a human being. Our job is to keep these distinctions in front of the trial team so the argument rests on what the record can carry.

Consider a dispute over an instruction allegedly sent before a wire transfer. We compare the supplied copy with the recipient’s retained records, the surrounding thread, the server logs and any independent copy held by a third party, and we look for the identifiers that a genuine message leaves behind. Where the records agree, we say so. Where they conflict, we explain the innocent explanations we ruled out before anyone attributes the difference to deliberate manipulation.

Which of the four questions does your matter turn on? Call (800) 868-8189 with that question and the scope will aim at it first.

The material that matters includes native message files, mailbox exports, server and transport records, account audit logs and related device evidence. An examination has to separate the content of a message from the evidence of its transmission, receipt and review, and it has to account for what export, migration and forwarding software does to a message along the way, because those tools change how a message looks without anyone intending to deceive.

Collection history is part of the opinion. We document who supplied each item, in what format, and what is known about how it was exported or preserved, and we prefer independently retained copies for comparison whenever they exist. Missing records and timestamp discrepancies are explained in the report rather than left for the other side to discover, which is how an opinion holds together under cross examination.

The digital forensics process guide explains how native records are acquired, examined and reported before any opinion is written.

Counsel receives documented findings, a timeline, exhibits tied to the specific records they rest on, a review of any opposing opinion and expert testimony from the examiner who did the work. Before the opinion is formed we confirm the expert’s relevant experience, conflicts and availability for the dates on the schedule, so there is no scramble at the disclosure deadline.

An authenticity exhibit should show the exact difference under discussion and name its source, so a judge or juror can follow the comparison without trusting a screenshot or a label generated by software. Where the evidence supports more than one explanation, the report sets out each alternative and names the additional records that would decide between them.

Ask who would sign the report and take the stand: the examiners and their credentials are set out on the About page.

The examination covers headers, message identifiers, attachment versions, time handling and the differences between the sender’s and the recipient’s records. We compare every copy in circulation, then go after the native message and the independent delivery records that can test the story being told about it.

A discrepancy demands an explanation before it supports a conclusion. Migration, forwarding and export tools all change how a message appears, and we rule those possibilities in or out before anyone says the word fabrication. That discipline is what lets the metadata speak for itself when timestamps disagree across copies.

The useful result is a supported answer to the disputed question. That may be a finding that the copies are consistent or evidence that the message was altered or fabricated, and either way the opinion rests on records the other side can examine for itself. The report identifies the material examined, the method applied and the basis for each opinion, and the examiner who wrote it is the one who takes the stand.

When the question is about collecting and examining the mailbox itself rather than giving an opinion on it, start with email forensics.

ComLab sued Kal Tire for breach of contract and produced paper copies of emails and invoices it said proved the agreement. When Kal Tire asked for the native files, ComLab answered that the original email data had been deleted after a computer virus. Kal Tire retained Joseph Caruso of Global Digital Forensics to examine that explanation and the metadata in the disputed emails, invoices and related documents, and the United States District Court for the Southern District of New York accepted him as an expert in computer forensics and computer science.

He showed that the invoice metadata had likely been manipulated because the last modified date and time fell after the date last saved in multiple instances, that other documents had been altered during the same period, and that server evidence existed which could have tested whether the emails were ever sent. The court found his experience impressive and his testimony reasonable, logical, and ultimately highly credible, concluded by clear and convincing evidence that the emails had been fabricated and the evidence spoliated, dismissed the action with prejudice and awarded Kal Tire its reasonable fees and costs. Read the COMLAB v. Kal Tire case study, which links the court’s opinion.

Joseph Caruso, founder, CEO and CTO, holds the CISSP and was accepted by a federal court as an expert in computer forensics and computer science in COMLAB v. Kal Tire, where his examination of a claimed virus and the disputed documents’ metadata was at the center of the hearing. His technology career began in 1980 and includes consulting expert work in Motorola Mobility v. Microsoft and Apple v. Samsung.

Veronica Perez, Senior Computer Forensic Specialist and EnCase Certified Examiner, has been designated as a digital forensics expert witness in California, Oklahoma and South Carolina state courts and in federal court in Chicago, and examines the mobile devices on which so much disputed email is now read and sent. Robert Knudsen, Computer Forensics and Cybersecurity Specialist, holds the CISSP and Certified Computer Examiner credentials and has conducted hundreds of computer and mobile device examinations supporting federal and state court matters. Meet the GDF team and ask for a current CV. Expert selection, conflicts and availability are confirmed during scoping.

Call (800) 868-8189 to talk it through with an examiner, or send the details.