Authenticity of an email? RRS feed

  • Question

  • Hi

    I work for a legal Firm and we are in a tricky situation.

    One of our staff was involved with discussions with an external body about a year ago. Now, there is some disagreement about what the outcome was. The external user has forwarded a mail chain between our user (John) and the external user.

    John only has vague recollections of this can be sure whether he said what is written in the mail chain or not. Unfortunately, he has deleted the item from his mailbox.

    I know when a mail is forwarded, the content can be changed.  But

    i. Is there anyway to find out if the forwarded mail has been altered?

    ii. If we asked for the forwarded mail, but as as MSG file as an attachment, could it have been ameneded that way?

    We are running Exchange 2007 SP2 with Outlook 2007 clients
    Monday, June 20, 2011 6:57 PM

All replies

  • 1. I take it there's no backup that you have taken which would have the original email.  If you have the restore.

    2. It would be difficult to determine if the msg was altered and by whom, date/time etc...more importantly the content.

    • Marked as answer by Neil4933 Monday, June 20, 2011 8:56 PM
    • Unmarked as answer by Neil4933 Monday, June 20, 2011 8:56 PM
    Monday, June 20, 2011 8:09 PM
  • If you do not have the original email, then your answer to #1 is no, #2 is a "I dont think so".
    Monday, June 20, 2011 8:39 PM
  • Thanks...

    As regards question 2, an email saved as an MSG and then forwarded could not be altered we are saying?

    We do use Journaling, but the user wasn't in the correct group for journaling at the time.

    Monday, June 20, 2011 8:57 PM
  • It would be difficult but can be done, but this cannot be guaranteed, for a legal case this, would probably wouldn't stand, hence why jounaling would.
    Monday, June 20, 2011 10:29 PM
  • Hi,

    From your description, you can try to check the journaling.  

    And do you have any update?


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Thursday, June 23, 2011 7:15 AM