Page 1
EMAILTHREADING · A GUIDE FOR UK LAWYERS Email Threading Inclusive Emails, Branching Conversations and Reviewing the Thread Instead of the Noise COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM THREAD AUTHENTICIT Y EXAM IN AT I ON CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: forty emails, three conversations 03 How threading works: headers, bodies and chain detection 04 Inclusiveness: what it means and what it licenses 05 Branches, drops and edits: the patterns worth hunting 06 Threading in review strategy and production 07 Thread authenticity: when the chain itself is contested 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: REVIEWTHEINCLUSIVEEMAILS, HUNTTHEBRANCHES: THE EFFICIENCYANDTHEEVIDENCECOMEFROMTHESAMEMAP
§ 02 · FIRST PRINCIPLES The problem in plain English: forty emails, three conversations
§ 03 · THEMECHANICS How threading works: headers, bodies and chain detection
Page 2
§ 04 · THELICENCE Inclusiveness: what it means and what it licenses
§ 05 · THEHUNT Branches, drops and edits: the patterns worth hunting
§ 06 · IN THE WORKFLOW Threading in review strategy and production
§ 07 · WHENTHECHAINISTHEQUESTION Thread authenticity: when the chain itself is contested
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE PARTY'S GATEWAY PRODUCING SERVER & COPIES LOGS COUNTERPART JOURNALS / RENDERS / DELETED / MAILBOXES ARCHIVES ADJACENT RECOVERABLE DMS / CHANNELS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEQUOTATIONTHATLOSTASENTENCE EXAMPLE2 · THEBRANCHSCHEDULETHATDATEDKNOWLEDGE EXAMPLE3 · THEINCLUSIVE - ONLYSHORTCUT, CAUGHTANDREPRICED
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · THREADING PA R AG RAPHFORTHEDISCLOSUREPROTOCOL
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The threading checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions How much review does threading actually save? If we review only inclusive emails, are we missing anything? Can we produce only the final email in each chain, since it contains the rest? The opponent's exhibit is a long printed chain. How do we test it? Someone deleted the middle of a thread. Is the conversation lost? Does threading work on Teams, Slack and Whats App too?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Email Threading, Computer Forensics Lab, https://e-discovery.uk/library/email-threading/pdf.