Forwarded email aut...
 
Notifications
Clear all

Forwarded email authentication

4 Posts
3 Users
0 Likes
430 Views
(@israellesg)
Posts: 7
Active Member
Topic starter
 

Hello Everyone,

Is there a way to check the veracity of the content of a forwarded email?

Let's say I send an email to my boss asking for green light for buying a TD3. He replies back to me says "NO" and I forward that email to seller changing the content from my boss email to "Yes".

I have done some testing looking at headers but there is no information there that specifies the email has been altered. Moreover, the thread index is the same.

The only thing I can think about is to put the emails with same thread index together and check the differences with a tool.

Do you have any experience, thoughts or ideas about this?

Thanks in advance.

 
Posted : 14/02/2013 8:10 pm
(@pragmatopian)
Posts: 154
Estimable Member
 

In most cases there isn't a means to check within the message as far as your email client is concerned the body of the original message usually just becomes part of the body of your message when you forward it, so you can edit it as you please (although depending on the settings of your mail client it may do helpful stuff like marking comments you make on the forwarded message with your name).

As you suggest, the best thing would be to identify mails in the same thread and from different sources (e.g. your computer, your boss' computer, the mail server) and compare the content. I did this myself on a case where it was alleged that certain copies of particular emails had been falsified.

 
Posted : 14/02/2013 10:24 pm
(@israellesg)
Posts: 7
Active Member
Topic starter
 

In most cases there isn't a means to check within the message as far as your email client is concerned the body of the original message usually just becomes part of the body of your message when you forward it, so you can edit it as you please (although depending on the settings of your mail client it may do helpful stuff like marking comments you make on the forwarded message with your name).

As you suggest, the best thing would be to identify mails in the same thread and from different sources (e.g. your computer, your boss' computer, the mail server) and compare the content. I did this myself on a case where it was alleged that certain copies of particular emails had been falsified.

That's what I was thinking )

Thanks for your answer.

 
Posted : 14/02/2013 11:18 pm
(@joachimm)
Posts: 181
Estimable Member
 

See http//code.google.com/p/libpff/downloads/detail?name=PFF%20forensics%20-%20e-mail%20and%20appoinment%20falsification%20analysis.pdf

 
Posted : 15/02/2013 12:23 am
Share: