Digital Forensics for Emails: What Information Can You Find in an Email?

Did you know that office workers in the United States receive approximately 120 emails daily at work, and these same workers send almost 40 emails daily?

No wonder emails are a key source of electronic evidence in a digital forensics collection.

As an attorney or paralegal, while you may only think of an email to contain its main contents and one or multiple attachments, that is not the only type of data emails contain.

Legal teams can discover a wide range of useful and relevant information from an email, and this data can be crucial in a document review, establishing timelines, and revealing intentions or agreements between parties.

So, what can a digital forensics collection uncover in an email?

Metadata

It refers to information in an electronic document that is not easily visible. Metadata is sometimes called information about other information, and in an email, serves several functions.

Typically, it describes the information about the email, including its attributes, content, and context.

It helps legal teams to easily search and retrieve specific emails from a broader population since it contains information such as the date an email was created or sent, as well as both senders and recipients of communications.

The most common use of metadata for legal teams is with indexing. When the metadata of emails is fully indexed, it becomes a powerful tool for weeding through the noise and pulling together a subset of information that is relevant to a specific topic.

Attachments

When reviewing emails, it is important to consider the entire email “family.” An email can also contain attached images, spreadsheets, and other files that contain an additional email message or information. It is typical for people to send invoices, contracts, and other types of documents that can make up the document review population.

They can provide evidence, context, or details that are critical to the case. Attachments may also contain embedded files, such as images and spreadsheets, and reviewing the metadata in them can provide context.

By contrast, hyperlinks are within an email rather than directly attached to it. Instead of sending the actual file, the sender provides a link to where the document is stored, for example, a document management system, cloud storage, or collaborative workspace.

Courts are still defining how to treat hyperlinks, so legal teams will need to address them in their ESI (Electronically Stored Information) agreements to avoid issues.

Content

In an email, likely the first thing legal teams review is the content. Emails contain direct communication between parties and can reveal intentions, agreements, incriminating statements, potential actions, and how one person feels about another.

The content can also provide evidence of events and actions. By mentioning specific transactions and decisions, emails can provide surrounding context that might be difficult to get without seeing a complete universe of content or email forensic investigation.

Understanding this content may help legal teams devise an effective litigation strategy and can inform case theories, identify key witnesses, and provide context for arguments in court.

Relationships And Actions

Communication patterns and metadata can help legal teams identify relationships between organizations, individuals, and other entities. In the same way, they can also reveal hierarchies and how power flows through an organization.

Legal teams can review who communicates with whom, how they talk to each other, the frequency with which they communicate, and this can identify themes, recurring issues, or suspicious behavior. They can also reveal collaborations and potentially reveal insiders and whistleblowers.

Emails can often reflect emotions, attitudes, and intentions. Angry, apologetic, or celebratory tones provide context.

Timelines can carry importance in many ways. They can help reconstruct the order of communication events, especially when understanding the sequence of interactions is important. They can reveal the context behind a decision; did the email precede a significant business move or decision?

Timelines can also highlight responsiveness and periods of silence. How quickly parties react to urgent matters can impact legal arguments.

Confidential or Privileged Information

It is understandable for people to assume emails are safe to send confidential or privileged information in them, but they may not always be thinking of the legal implications. This information can inform a legal strategy and decision-making if uncovered and reviewed.

A legal team that goes through an email collection can discover this information and can then decide whether they should redact, protect, or use it in their case. Identifying and segregating confidential and privileged documents is a key step and can ensure relevant evidence is disclosed.

Your email collection can reveal a lot more besides the subject. Email investigations can unveil the content appearing on mail servers, and inside an email, offering invaluable insights for legal teams navigating their document review.

In the end, this data can be pivotal in building their case. The significance of any data they find, including insights from email server investigations, will depend on the case, but email data will always have the potential to uncover facts and information that can help or hurt.

The next time you prepare an email, you may want to think twice before you hit send.

Conclusion

Your email collection can reveal a lot more besides the subject. The content appearing on, and inside an email, can contain information that can help legal teams navigate their document review, and in the end, build their case.

The significance of any data they find will depend on the case, but email data will always have the potential to uncover facts and information that can help or hurt.

The next time you prepare an email, you may want to think twice before you hit send.