Email Threading

EMAILTHREADING · AGUIDEFORUKLAWYERS Email Threading Inclusive Emails, Branching Conversations and Reviewing the Thread Instead of the Noise COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM THREAD AUTHENTICIT Y EXAMINATION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: forty emails, three conversations 03 How threading works: headers, bodies and chain detection 04 Inclusiveness: what it means and what it licenses 05 Branches, drops and edits: the patterns worth hunting 06 Threading in review strategy and production 07 Thread authenticity: when the chain itself is contested 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : REVIEWTHEINCLUSIVEEMAILS , HUNTTHEBRANCHES : THE EFFICIENCYANDTHEEVIDENCECOMEFROMTHESAMEMAP § 0 2 · FIRSTPRINCIPLES The problem in plain English: forty emails, three conversations § 0 3 · THEMECHANICS How threading works: headers, bodies and chain detection § 0 4 · THELICENCE Inclusiveness: what it means and what it licenses § 0 5 · THEHUNT Branches, drops and edits: the patterns worth hunting § 0 6 · INTHEWORKFLOW Threading in review strategy and production § 0 7 · WHENTHECHAINISTHEQUESTION Thread authenticity: when the chain itself is contested § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE PART Y'S GATEWAY PRODUCING SERVER & COPIES LOGS COUNTERPART JOURNALS / RENDERS / DELETED / MAILBOXES ARCHIVES ADJACENT RECOVERABLE DMS / CHANNELS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEQUOTATIONTHATLOSTASENTENCE EXAMPLE2 · THEBRANCHSCHEDULETHATDATEDKNOWLEDGE EXAMPLE3 · THEINCLUSIVE - ONLYSHORTCUT , CAUGHTANDREPRICED § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · THREADING PA R AG RAPHFORTHEDISCLOSUREPROTOCOL § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The threading checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions How much review does threading actually save? If we review only inclusive emails, are we missing anything? Can we produce only the final email in each chain, since it contains the rest? The opponent's exhibit is a long printed chain. How do we test it? Someone deleted the middle of a thread. Is the conversation lost? Does threading work on Teams, Slack and WhatsApp too? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY