In litigation and internal investigations, email is often a goldmine of evidence. But not all “copies” of an email are created equal. The moment an email is forwarded, printed, or screenshot, valuable forensic information is stripped away.
This invisible data, known as metadata, can make or break a case. And once it’s gone, it’s usually gone for good.
What is Metadata?
Metadata is the hidden layer of information that travels with a digital file. In email, it can include:
- Sender and recipient addresses (including hidden “BCC” fields)
- Exact send/receive timestamps (with time zone details)
- Mail server routing details showing where the email traveled
- Authentication results that help prove the email’s legitimacy
This is the kind of information that helps a forensic examiner prove authenticity, verify timelines, and identify fraud or tampering.
Why Forwarding, Printing, or Screenshotting is a Problem
When someone forwards an email, it creates a new message, overwriting or more importantly, omitting the original metadata.
When someone prints or screenshots it, the metadata is lost entirely.
In short:
- Forwarding- Alters original evidence.
- Printing/Screenshotting- Destroys key forensic details.
How Mishandling Email Evidence Can Hurt a Case
- Loss of Authenticity Proof – Without metadata, it’s harder to confirm the email wasn’t altered.
- Weaker Timelines – Forwarded or printed copies may show the wrong dates or times.
- Missed Hidden Recipients – Original “BCC” recipients disappear in forwarded or printed versions.
- Doubt in Court – Opposing counsel may challenge the validity of the evidence.
Best Practices for Preserving Email Evidence
- Preserve the Original File – Save emails in their native format (.PST, .EML, or .MSG).
- Involve a Forensic Expert Early – We can collect emails directly from the source to preserve all metadata.
- Avoid “Opening and Saving” in Different Formats – Even changing formats can strip metadata.
- Educate Staff and Clients – Ensure anyone involved in evidence handling understands the importance of keeping the original intact.
How Digital Forensics Helps
At Swailes Computer Forensics, we:
- Use forensic tools to extract email directly from servers, cloud accounts, or devices.
- Preserve metadata exactly as it existed at the time of collection.
- Analyze email headers and routing to verify authenticity.
- Prepare defensible reports for use in court or internal investigations.
In disputes where email plays a central role, the difference between winning and losing can be hidden in the metadata. Don’t let crucial evidence get lost in translation.
If you suspect an email will become important in litigation or an investigation, contact Swailes Computer Forensics immediately. We’ll help ensure it’s collected properly, preserved in full, and ready to stand up in court.
About Swailes Computer Forensics
Swailes Computer Forensics provides expert digital forensic services to law firms, corporations, and organizations nationwide. Our work includes investigations into intellectual property theft, employee misconduct, data breaches, and more. With decades of experience and a commitment to integrity and clarity, we help clients uncover critical evidence and take informed action.
If you’re facing a potential case of employee data theft or have concerns about unauthorized activity, contact us for a confidential consultation.