When analysing correspondence, a printout or copied text alone may not answer questions about a message's origin, transmission route or attachments. It is useful to prepare message files in the format offered by the email program, preserve full headers and describe which account they came from. The scope of the export should suit the case: a single message, a particular thread or an agreed time period.

Preserve the message as a file

In Gmail on a computer, Google provides a ‘Download message’ command that saves an email as an EML file. This is a useful way to provide a message together with its structure. Google's documentation also describes sending emails as attachments; simply pasting text into a new message produces a different form of material. Before handing over files, agree on how to deliver them for examination. [1]

If you use another program, give its name and version. Ask about the appropriate export rather than manually changing a file extension or copying the content into a text editor. Keep the message in your mailbox and work on a prepared copy. A file list may contain your own reference numbers, but should not replace a description of where each file came from.

Include full headers

Technical headers contain more than the visible ‘From’, ‘To’ and ‘Subject’ fields. Google states that, in Gmail, the full header can be displayed through the message menu using ‘Show original’. This provides access to information needed to analyse an email's transmission route. A screenshot of the top of the window usually shows only a selected view of that data. [2]

In Outlook, the route depends on the version. Microsoft’s documentation describes message details in the new Outlook and web version, and the ‘Internet headers’ field in the properties of a separately opened message in classic Outlook for Windows. Use instructions for the program you are using; the absence of a particular menu item does not establish that headers are unavailable. [3]

Time, identifiers and authentication require interpretation

RFC 5322 distinguishes, among other things, the Date field, Message-ID, reply relationships and transport trace fields. Date represents the time the message was prepared for sending according to its creator, rather than automatically the time it was delivered to the recipient. Time zone differences and successive transport stages must be considered in the context of the complete headers. [4]

A DKIM signature can provide information about the responsibility of the signing domain and the integrity of the data covered by the signature. RFC 6376 expressly distinguishes the identity of the signing entity from the claimed author. A successful verification result does not, by itself, identify the person who wrote the message or confirm that the recipient read it. The sender address displayed in the email program does not resolve these questions either. [5]

Prepare the thread and attachments within the agreed scope

Explain which question needs answering. Does it concern the content of agreements, a difference between attachments, the sequence of events or the origin of a particular email? Identify the messages directly related to the issue and describe whether they constitute the complete correspondence or only a preserved portion. You do not need to send your entire mailbox to explain the proposed commission.

  • Preserve available original message files and their full headers.
  • Include attachments as received, without resaving them in an editor.
  • Provide the account and folder the export came from.
  • Identify material received from other people and known transfer dates.
  • Describe any earlier forwarding, printing or conversion of the material.
  • Prepare a brief chronology and a list of questions for analysis.

In your description, separate possession of the message from conclusions about its author. Account passwords are not needed for the initial enquiry. The method of sharing material, scope of data and any account access should be agreed beforehand.

Hypothetical example

A company receives two emails with similar subjects but different bank account numbers on the invoices. Instead of providing printouts alone, it prepares both messages as files, preserves the attachments and describes when the difference was noticed. This set makes it possible to ask separate questions about the file contents, headers and sequence of correspondence. It does not yet establish who made the change or whether the available material will be sufficient to determine this.

Sources

Primary documents; accessed: 23 October 2026.

Digital forensics—scope of examinations →