A couple of ideas that might help with detection:

[quote="TerracottaFaceloth"]
1. As Mallory at no point used SMTP, there are no changes to the original email other than those Mallory chose. That ...

[quote="UnallocatedClusters"]
The suspected fraud includes the manual manipulation of the sent emails.[/quote]

If this manual manipulation took place after the email passed through the MTA, I woul ...

Hi John,

I'm glad you've found it helpful. Thanks for sharing your question with the community!

[quote="jahearne"]
Hi Arman,

Nice work on your article!

https://articles.forensicfocus.com/ ...

[quote="jahearne"]
I didn't know about the server Internal Date Message Attribute, unfortunately, Nuix doesn't pick up on that. In my example (my personal Gmail account), not sure what the UID woul ...

In my experience, altering the message the way you described when connected to Gmail via IMAP would cause Gmail to assign the message a new unique identifier ([url=https://tools.ietf.org/html/rfc3501# ...

I can imagine that your budget and other practical issues may prevent you from doing things the way you wish—such as getting more software licenses. That said, it sounds like there are a few minor a ...

I am not familiar with Phone Rescue but a good starting point might be to identify the file types you have from their binary signatures. You could use a forensic suite such as X-Ways, or something alo ...