On 19/11/23 01:59, Alex wrote:
IMAP clients will therefore keep messages on the IMAP server and not delete them unless you specifically tell them to, for example via right-click -> delete.
A client can also alter messages retained on a server or event insert new messages. This is interesting in computer forensics.
It means that if an email is on a server e.g. hotmail or gmail, it has no probative value unless supported by other evidence such as server records, digital signatures, or corroborating evidence on other systems.
In my professional cyber-forensic practice I have tested just how much you can alter in an email on a server. The answer is essentially everything. All headers, dates, content etc.
Server records of email receipt are usually transient so after a few months they can no longer be used as corroboration.
