On 19/11/23 01:59, Alex wrote:
IMAP clients will therefore keep messages on the IMAP server and not
delete them unless you specifically tell them to, for example via
right-click -> delete.
A client can also alter messages retained on a server or event insert
new messages. This is interesting in computer forensics.
It means that if an email is on a server e.g. hotmail or gmail, it has
no probative value unless supported by other evidence such as server
records, digital signatures, or corroborating evidence on other systems.
In my professional cyber-forensic practice I have tested just how much
you can alter in an email on a server. The answer is essentially
everything. All headers, dates, content etc.
Server records of email receipt are usually transient so after a few
months they can no longer be used as corroboration.