Alter an email message in your mailbox

jahearne · 2019-01-17T05:04:42Z

I am working on a case where someone allegedly entered a sentence into the body of an email message after it was originally sent to 3 people. This alleged email is a reply to an email my client sent.I have online access (usernames and passwords) to two of those three email accounts (my client's Gmail account and another Yahoo account). My client has the original email in his Sent Items. And both Gmail and Yahoo accounts, each have the alleged reply message in their Inboxes. The reply message in the Gmail & Yahoo accounts do NOT have that allegedly added sentence. (I used Nuix to collect and preserve the email messages.)My client is asking me to prove that the allegedly added sentence is a forgery!It is my understanding and experience that you can not modify the body of an email message while is it sitting in your Inbox. There is no way that they could have deleted/removed that alleged sentence, can they? I know in an email chain, you can modify the body of a previous message when you reply (or forward ???) it; that's easy to do. But can you modify it once you received it in your Inbox. Is there an email client that can do so that anyone knows of (and of course sync it back to the server?Of course if I am challenged, my client's counsel can request the alleged reply message from the sender and the other 3rd person.I appreciate any insight, thanks!

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by gungora 6 years ago

11 Posts

4 Users

0 Reactions

5,616 Views

RSS

gungora

(@gungora)

Eminent Member

Joined: 8 years ago

Posts: 33

01/03/2019 6:16 pm

Hi John,

I'm glad you've found it helpful. Thanks for sharing your question with the community!

Hi Arman,

Nice work on your article!

https://articles.forensicfocus.com/2019/01/29/forensic-examination-of-manipulated-email-in-gmail/?unapproved=116215&moderation-hash=9b162c66f40148eaa5baec9fa26ab848#comment-116215

I think the FILETIME date could be the key in my case!

Thanks,
John