- Nationwide Digital Forensic & Cyber Investigation Services
Quick answer. Email E-Discovery is the forensic collection, processing and production of mailbox data for litigation and investigations. Collection is performed through server side interfaces such as Microsoft Purview or Google Vault, or from local containers including PST, OST, MBOX, EML and MSG files, with hash verification and chain of custody. Processing extracts attachments, threads conversations, removes duplicates across custodians, normalizes time zones and applies targeted search criteria. Where authenticity is contested, internet headers, transport records and audit logs are analyzed to establish whether a message was actually sent, received or altered.
| Question | Short answer |
|---|---|
| What sources do you collect? | Microsoft 365, Exchange on premises, Google Workspace, IMAP accounts, PST, OST, MBOX, EML and MSG. |
| Why not export from Outlook? | Desktop exports can alter metadata and miss server side items, folders and audit context. |
| Can you prove an email is fake? | Often. Header inconsistencies, missing transport records and absent server logs are strong indicators. |
| How is volume reduced? | Deduplication across custodians, threading, near duplicate grouping and targeted search criteria. |
| Are attachments handled? | Yes. Attachments are extracted, hashed, indexed and linked back to the parent message. |
| Can deleted email be recovered? | Frequently, from recoverable items, archives, journals, backups or local containers. |
| What formats do you produce? | Native MSG or EML, searchable PDF, TIFF with extracted text and load files with metadata fields. |
| Do you handle privilege? | We support privilege workflows with search terms and logs; privilege calls remain with counsel. |
| Source | Collection approach | What it adds |
|---|---|---|
| Microsoft 365 and Exchange Online | Purview holds, compliance search and export | Server metadata, recoverable items, unified audit log context |
| Exchange on premises | Mailbox export requests or database level acquisition | Journaling data, transport logs, mailbox database remnants |
| Google Workspace and Gmail | Vault holds, searches and exports | Label structure, message identifiers, admin audit context |
| IMAP and hosted mail | Authenticated server side acquisition of folders and messages | Folder structure and server timestamps |
| PST and OST files | Forensic collection from the endpoint and container parsing | Local archives, cached items, orphaned messages |
| MBOX, EML and MSG | Direct ingestion with hashing | Individually produced or exported messages |
| Email archives and journals | Export from the archiving platform | Long term retention copies and immutable journal records |
| Backups and virtual machines | Restoration of mail stores from backup media | Historical mailboxes deleted from the live environment |
Where possible we collect from the server rather than the desktop. A server side collection preserves fields the desktop never sees, captures items in recoverable folders, and can be tied to audit records that establish access and deletion history.
Volume reduction on email is usually the largest cost lever in the matter. Between DeNISTing of system files, cross custodian deduplication, threading and targeted criteria, raw collections are commonly reduced by a large majority before attorney review begins. Every reduction step is recorded so the methodology can be described to opposing counsel or the court.
A printed email proves very little. Authenticity analysis works from the technical record that surrounds a message rather than the text on the page.
Full internet headers record the servers a message traversed, the times each hop occurred, the message identifier assigned at origin, and authentication results such as SPF, DKIM and DMARC evaluation. A fabricated message frequently shows inconsistencies: a message identifier that does not match the sending domain's format, hop timestamps that run backwards, missing authentication results, or a path that never touches the purported sender's provider.
Where the account is still accessible, the strongest evidence is the server record. Message trace data, mailbox audit records and unified audit logs establish whether the item was ever delivered, whether it was opened, whether a rule moved or forwarded it, and whether it was deleted and by whom. An email that exists only as a local file, with no corresponding server record and no counterpart in the recipient mailbox, invites a very direct question.
Where a produced message differs from the copy in another custodian's mailbox, comparison of the two items, their hash values, their attachment sets and their headers identifies exactly what changed. Findings of this kind are documented in a report suitable for filing and supported by testimony.
Auto forwarding rules to personal addresses are a recurring pattern in data theft matters and often predate a resignation by weeks.
Sign in records show location, client application and time, which can establish access from a competitor's network or after termination.
Audit records identify bulk deletions, folder purges and recoverable item removals, including the account that performed them.
Delegate and shared mailbox permissions explain how a message was sent by an account other than its owner.
Compliance search and export events, and eDiscovery activity by an insider, appear in the audit record.
Policy edits that shorten retention after a preservation obligation attaches are a documentable spoliation indicator.
Audit and sign in logs expire on a retention schedule that varies by license. Preserving them early is often more urgent than collecting the mailbox itself.
| Deliverable | Typical use |
|---|---|
| Native MSG or EML with load file | Review platform ingestion with full metadata fidelity |
| Searchable PDF | Exhibits, mediation binders and small productions |
| Single or multi page TIFF with extracted text | Productions governed by an ESI protocol requiring imaged output |
| Metadata field set | From, To, Cc, Bcc, subject, sent and received times, message identifier, folder path, attachment names and hash values |
| Attachment family production | Parent messages produced with children intact and consistent numbering |
| Production log and hash manifest | Evidence of what was produced, when, and in what state |
Time zone and numbering conventions should be settled before production rather than after. A production that mixes local and coordinated universal time, or that breaks attachment families, generates avoidable disputes and rework at the worst point in the schedule.
This page is part of the Elite Digital Forensics E-Discovery services hub. Related coverage:
We identify the mail environment and custodians with counsel, apply holds where a duty to preserve has attached, and collect server side wherever the platform allows, with hash verification and chain of custody. Processing expands containers, extracts attachments, deduplicates across custodians, threads conversations and normalizes time zones before targeted criteria are applied. We then produce in the format the protocol requires with a production log and hash manifest, and where authenticity or deletion is disputed, our examiners analyze headers and audit records and testify to the findings.
Elite Digital Forensics is an independent digital forensics firm providing nationwide E-Discovery services, computer and mobile device forensics, cloud and email investigations and expert witness testimony. Our examiners include former law enforcement forensic examiners and court qualified expert witnesses. We work for law firms on both sides of the docket, for corporations and in house legal departments, and for insurers. When retained through counsel, our work is generally treated as attorney work product prepared in anticipation of litigation.
A desktop export copies what the client's local profile happens to hold. It can alter metadata, omit items in recoverable and archive folders, break folder provenance, and produce nothing that ties the messages to server records. A server side collection through the native compliance interface preserves those fields and can be corroborated with audit logs, which matters if authenticity or completeness is later challenged.
Frequently, yes. Analysis focuses on the full internet headers, the message identifier, the transport path and hop timestamps, authentication results such as SPF, DKIM and DMARC, and whether a corresponding record exists in the sending or receiving server logs. A message with no server record, an inconsistent identifier or an impossible hop sequence is a strong indicator of fabrication, and the analysis is documented in a report supported by testimony.
Often. Depending on the environment, deleted messages may persist in recoverable items folders, in archive or journal repositories, in local PST or OST containers, in backups, or in the mailbox of another participant to the thread. Audit records can also establish that a deletion occurred and who performed it, which is evidence even when the content itself is gone.
Substantially. DeNISTing, hash based deduplication across custodians, container expansion, conversation threading, near duplicate grouping and targeted date, participant, domain and keyword criteria typically remove the large majority of a raw collection before a reviewer sees a document. Each step is recorded so the reduction methodology can be defended.
A standard set includes From, To, Cc and Bcc, subject, sent and received timestamps with a stated time zone, message identifier, conversation identifier, folder path, custodian, attachment names and counts, file sizes and hash values. Field selection is matched to the ESI protocol or court order governing the matter.
We support the workflow; the privilege calls belong to counsel. That support includes search terms and domain lists to identify counsel communications, segregation of hits for attorney review, privilege log data extraction, and where required, production with privileged families withheld and logged.
Yes. Collection is performed through Microsoft Purview and Google Vault administrative interfaces on the server side. Users are unaffected and, in most configurations, unaware. Holds can be applied first so retention policies and user deletion do not remove potentially relevant material while collection is scoped.
As early as possible. Audit, message trace and sign in log retention is limited and varies by license tier, and in some configurations records are available for only a matter of months. In data theft and account compromise matters those logs are frequently the most probative evidence, so preserving them is often more time critical than the mailbox contents.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic and E-Discovery services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder