So I know this should be basic but I'm having a hard time with this one.
I have an email that was supposedly altered before it was forwarded, but can't seem to figure out any indications that it was.
I tested using the same clients, and Gmail was able to determine that text had been altered in the middle of the email string before being sent. It showed the "…" for the top portion of quoted text, then the text that was altered, then another "…" for the text below it.
When I loaded it into FTK though, it just shows the entire message and shows no indications of altered text.
I can't figure out how Gmail was able to determine not only that it had been altered, but what portion of the email string was altered before being sent.
Does anyone know which email header property I should be looking at?
Thanks,
if x orginating ip adress header different from google mail server ip adress maybe you can identify but not exactly
I am sure Gmail is not able to find out, less warn, that a forwarded email was altered or modified in any way.
What concerns the email header you will only find the usual, but no references to modifications of the body, ie. the message itself.
