Page 1

EMAILTHREADING · A GUIDE FOR UK LAWYERS Email Threading Inclusive Emails, Branching Conversations and Reviewing the Thread Instead of the Noise COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM THREAD AUTHENTICIT Y EXAM IN AT I ON CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: forty emails, three conversations 03 How threading works: headers, bodies and chain detection 04 Inclusiveness: what it means and what it licenses 05 Branches, drops and edits: the patterns worth hunting 06 Threading in review strategy and production 07 Thread authenticity: when the chain itself is contested 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: REVIEWTHEINCLUSIVEEMAILS, HUNTTHEBRANCHES: THE EFFICIENCYANDTHEEVIDENCECOMEFROMTHESAMEMAP

§ 02 · FIRST PRINCIPLES The problem in plain English: forty emails, three conversations

§ 03 · THEMECHANICS How threading works: headers, bodies and chain detection