Apple Mail Archives And Email Threading On MacOS
MAILARCHIVES & EMAILTHREADING · A GUIDE FOR UK LAWYERS Apple Mail Archives and Email Threading on macOS Reconstructing the True Conversation from the Local Store and the Headers COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the thread is the evidence 03 Where Apple Mail keeps its archive 04 What the headers reveal 05 Reconstructing the true thread 06 Authentication, doctored threads and honest limits 07 Deployment: selective disclosure and the real chain 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary email is a conversation whose true thread must be reconstructed from the technical headers rather than a party's presentation, which is where selective disclosure and doctored chains are exposed.
§ 02 · FIRST PRINCIPLES The problem in plain English: the thread is the evidence
§ 03 · WHERETHEARCHIVELIVES Where Apple Mail keeps its archive
§ 04 · WHATTHEHEADERSREVEAL What the headers reveal
§ 05 · RECONSTRUCTINGTHETHREAD Reconstructing the true thread
§ 06 · AUTHENTICATIONANDHONESTLIMITS Authentication, doctored threads and honest limits
§ 07 · DEPLOYMENT Deployment: selective disclosure and the real chain
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE PAIRED SERVER / MAC MAIL COUNTERPART BACKUPS / DELETED / ARCHIVE MAILBOXES SNAPSHOTS RECOVERABLE ICLOUD / MAIL DEVICES LOGS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEREPLYTHATHADBEENQUIETLYDROPPED EXAMPLE2 · THEFABRICATEDEMAILCAUGHTBYITSHEADERS EXAMPLE3 · THEFULLHEADERSTHEPRINTOUTHADSTRIPPED
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAMAILARCHIVEANDTHREADING ANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Mail archive and threading checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Why not just rely on the printed email chain? What are email headers, and why do they matter? Can you rebuild the true conversation from a messy exchange? Can you tell if an email has been faked? Does the local archive have more than the server? How quickly should we preserve the Mac and mailboxes?
§ 14 · REFERENCE Glossary Sources and authoritative references 35 and CrimPR Part 19 reporting): cflab.uk/digital-forensics-services · guides library: cflab.uk/guides DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Apple Mail Archives And Email Threading On MacOS, Computer Forensics Lab, https://e-discovery.uk/library/apple-mail-archives-and-email-threading-on-macos/pdf.