Microsoft 365 / Outlook
Remote mailbox collection, message flow tracking, authentication records, tenant audit log analysis and eDiscovery for Exchange Online, Outlook, OneDrive and SharePoint.
Disputed Messages, Headers and Routing, Communication Maps
Email Forensics for Preservation, Authentication and Sender Analysis
A contract email the other side says was never sent, a forwarded message with a date that looks wrong, a mailbox someone else has been reading. Global Digital Forensics preserves the mailbox and the records around it and tests the disputed message against every one of them.
Why a Header Alone Never Settles an Email Dispute
DKIM validation checks a domain signature against the signed parts of a message and the key the domain published. It tells you the message passed through infrastructure that held that key. It does not tell you which human pressed send, whether the message reached the recipient or whether what it says is true. A forwarded copy, a rotated key, a missing original or a permitted unsigned portion can each limit what the signature can show, and an examiner who stops at the header has stopped too early.
We compare the retained header hops with the server, account and identity records on both ends, and we report infrastructure observations, account activity and conclusions about a person as three separate findings. The skill is knowing which records answer the question counsel is actually asking.
The references behind that work are public: the IETF's RFC 6376 on DKIM signatures and Microsoft's Purview audit log activities reference for the tenant side.
If a DKIM pass or a screenshot is being offered as proof of who sent a message, call (800) 868-8189 before anyone relies on it.
The practice
A Practice Built on Thousands of Collected Mailboxes
One disputed message can raise five questions: is it authentic, how did it move, was it altered, was it deleted and who else could read it. We preserve the mailbox, the message store, the server and tenant records and the devices that touched them, then answer each question from the records that bear on it.
Global Digital Forensics has served law firms and businesses since 1992. Across the email practice we have collected thousands of mailboxes, performed hundreds of compromised account analyses and handled hundreds of email related deposition and testimony engagements. Our work covers Microsoft 365, Exchange, Gmail, Google Workspace, hybrid environments and legacy stores, with remote collection where the matter allows it, preservation of the original and comparison against the server and audit records that no user can edit.
Attorneys who want to know who would testify can review the examiners and their credentials before the first call.
Start here
Pick the Service That Fits Your Platform
Each dedicated page sets out the collection methods, the findings and the next step for that environment. If the matter spans more than one, call and we will route it.
Gmail / Google Workspace
Vault and API collection, header and metadata analysis, Drive correlation and administrator audit records for managed domains and personal Gmail accounts.
Business Email Takeover
For a hijacked mailbox, we reconstruct the unauthorized access, the phishing that opened it, the forwarding and delegation it left behind and the data it reached, working alongside the authorized response team.
Litigation package for email and cloud
Coordinated preservation and analysis of email and connected cloud storage for litigation, arbitration and internal review when the question spans more than one platform.
Capability
Every Record the Disputed Message Should Have Left
We compare original messages and headers, mailbox and cloud copies, sending and receiving server records, tenant logs, devices and the independent copies held by other recipients. Where those sources agree, the account they support is strong. Where they conflict, the conflict itself is a finding, and the report shows what each source contributes.
Authenticity analysis compares native files, headers, times, message identifiers and attachments with independent copies, and reads DKIM, SPF and DMARC results within their proper scope rather than as a verdict.
Routing analysis reconstructs how the message actually travelled from server hops, transport logs, delivery records and mailbox activity.
Account analysis correlates login events, mailbox actions, forwarding, delegation, multifactor challenges and administrator changes so the activity around the message is as clear as the message itself.
Deletion analysis examines mailbox traces, cloud recovery areas, backups and available restore points, and documents exactly what can be restored and from where.
Exposure analysis examines inbox rules used to hide activity, delegated access, downloads, exports and personal or external accounts, keeping observed actions distinct from access that was merely possible.
The report keeps what the artifacts show apart from what is inferred from them. A displayed sender name, a screenshot or a forwarded copy is a starting point, never the finish, and that discipline is what holds up under cross examination.
Want the examination built around the one question that decides your matter? Get a free consultation and the scope letter follows from it.
Evidence commonly examined
Mailboxes, Logs and Files We Examine
Native messages and attachments arrive as PST, OST, MBOX, EML and MSG files. Microsoft 365 contributes mailbox, login and unified audit records, and Google Workspace contributes mailbox records, Vault exports and administrator audit data. Headers preserve the DKIM, SPF and DMARC observations we interpret, while rules, forwarding, delegation and permissions show how the mailbox was configured. OneDrive, SharePoint and Google Drive supply the files the messages link to, and device records provide independent context for attributing account activity to a person.
What you can expect
Findings, Timeline and Testimony
The acquisition record identifies the source, method, timing and integrity values for every item. Authentication findings connect header analysis with independent source comparisons, and the agreed timeline and communication map organize the supported account activity. Search results, review material and ESI load files support the agreed discovery delivery, the technical report separates observations from expert interpretation, and where we are retained to testify, deposition and trial testimony explain the findings and the methods behind them.
Before anyone exports the mailbox, tell us the account type and we will send back the preservation steps that keep the logs intact. Our guide Five Mistakes That Destroy Digital Evidence Before We Arrive starts with the casual copy that passes for a collection.
What you receive
A Documented Record Another Examiner Can Test
Every finding ties to a source artifact, and the engagement file records how the email evidence was acquired, handled and examined, so the foundation is ready before anyone challenges it.
You get the method, the record and the examiner to defend them.
When counsel needs the examiner to carry this record into a declaration or the witness box, our email expert witness service picks it up.
- Scope letter and stated assumptionsThe scope letter records the question, the material examined, the exclusions and the assumptions behind the analysis.
- Evidence handling recordThe handling record documents acquisition, integrity values, storage, transfer and custody for each mailbox, export and file.
- Methodology statementMethods, tool versions and procedures are documented so another qualified examiner can review or repeat the work.
- Findings, separated from interpretationEach finding identifies its basis and distinguishes observed fact from expert opinion.
- Open questions, namedThe report names any evidence that was unavailable and the questions it leaves for further collection.
Court tested
Email Analysis a Federal Court Called Highly Credible
In COMLAB, Corp. v. Kal Tire, a Southern District of New York matter built on disputed email, the plaintiff produced paper copies of messages and said the native data had been destroyed by a virus. Joseph Caruso analyzed the virus explanation and the metadata of the disputed emails and invoices and showed that the records had been manipulated. The court found his testimony reasonable, logical, and ultimately highly credible, found fabrication and spoliation by clear and convincing evidence, and dismissed the action with prejudice. Read the case and the court’s findings, or meet the forensic experts who would examine yours.
To put a senior examiner on this part of the matter, request a free consultation.
Frequently asked
Email Evidence, From Headers to Production
What is email forensics?
Email forensics is the documented preservation, examination and reporting of email evidence: the messages, headers, attachments, mailbox rules, activity records and security logs around them. It answers whether a message is authentic, who sent or received it, when it moved, whether it was altered, deleted or forwarded, and what the surrounding account activity shows.
How much does an email forensic examination cost?
Cost depends on the number of mailboxes, the platform, the deadline and whether testimony is required. Authenticating one message in one mailbox is a very different scope from reconstructing a compromise across several custodians. We agree the sources, the deliverables and the price during the first conversation, and that first consultation is free.
How long does an email forensic analysis take?
Timing is agreed once we confirm account authority, the accessible records, administrator availability, source size, retention and the question. A preservation or triage milestone comes first, the full report follows the analysis, and you always know which milestone you are waiting for.
Do you collect Microsoft 365 and Gmail email?
Yes. We collect Microsoft 365 mailboxes, Outlook data files, OneDrive and SharePoint files, and Gmail and Google Workspace including Drive. Routine collection normally proceeds remotely while users keep working in their accounts. See our Microsoft 365 and Google Workspace pages for the methods each platform supports.
Can you tell whether an email is real or altered?
In many cases, yes. We compare original message files, headers, timestamps, message identifiers, attachments and the independent copies held by servers and other recipients, and the report keeps what we observed apart from what we inferred.
Can you identify who actually sent a message?
Often. DKIM, SPF and DMARC results, routing information, mailbox activity, device evidence and correlating records can confirm or contradict claimed authorship, and we tell you how far the evidence goes before you rely on it.
Do you handle business email compromise and hacked mailboxes?
Yes. For an active takeover, containment and preservation run together with the authorized responders, and a necessary access revocation is never delayed for collection. Record every password reset, session revocation, rule change and export as it happens so its effect stays distinguishable from the attacker's. See Business Email Takeover Forensics.
Do you provide expert testimony on email evidence?
Yes. Our examiners have testified in federal and state courts, and the email practice includes hundreds of email related deposition and testimony engagements. See expert witness and neutral examinations.
Do you accept matters for individuals?
Yes, when the individual is represented by counsel. Estate, employment, contract and personal disputes that turn on email follow the same preservation and custody procedures as corporate work, and we size the scope to the stakes.
Do you handle internal corporate matters?
Yes. Trade secret, executive conduct, departing employee, business partner separation and other internal reviews follow the same evidence preservation and reporting discipline as litigation work. See trade secret and employee forensics.
Can we work to our ESI stipulation?
Yes. We align collection, search, duplicate handling, review preparation and production to the specification counsel approves, including metadata fields, attachment handling, extracted text and load file format. See our eDiscovery collections service.
Free consultation
Preserve the Messages and Logs Before the Other Side Asks
On the first call a senior examiner reviews the disputed messages, the platform and your deadline, tells you what to preserve today and scopes the collection, authentication and any expert opinion the matter needs.
GDF has operated since 1992 and offers court tested forensic expertise.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .