You receive an email that appears to come from a supplier, a partner or someone inside your company. They ask you to make an urgent transfer, change the bank details on an invoice or approve an operation. You do it. Then you find out the email was fake — the address had been manipulated, the domain was a copy, someone had been impersonating someone else. You have a complaint to file, a lawyer who needs documentation and a bank asking for proof.
Is a screenshot enough? No. Is an automatic report from an online scanner enough? No either. What you need at that point is a forensic analysis of the email carried out by a certified IT expert, with verifiable methodology and legal validity before courts, regulatory bodies and law enforcement.
🔍 Suspicious message?
Analyze senders, links or files in real time with our scanner.
What email forensic analysis is
Email forensic analysis is the technical process of examining a message in full depth — not just the visible text, but the technical headers, the metadata, the chain of servers it passed through, the authentication signatures and the indicators of manipulation — to determine its real origin, whether it has been altered and which technical evidence is relevant to the case.
Unlike an automatic analysis, which detects risk patterns in seconds, forensic expert analysis documents each finding with traceable methodology, preserves the chain of custody of the evidence and produces a report signed by an expert that can be presented in judicial or administrative proceedings.
The analysis includes, among other elements:
- Full header extraction and analysis — the technical fields that record every server the message passed through, with timestamps and IP addresses
- SPF, DKIM and DMARC authentication verification — whether the server that sent the message was authorised by the domain shown as the sender
- Sender domain analysis — age, registrar, history, whether it is a legitimate domain or was created to impersonate
- Manipulation detection — whether the message was altered after being sent, whether the headers are internally consistent or show inconsistencies
- Attachment and link analysis — whether they contain malicious code, whether links point to fraudulent domains, whether there are malicious QR codes or documents with macros
- Chain of events reconstruction — what happened, in what order and from which infrastructure
When you need a forensic email expert report
Not every case requires expert intervention. An automatic analysis is enough to know whether a message is suspicious before opening it. But there are situations where automatic analysis is not the right instrument — because what is needed is not a risk verdict, but documentation with legal validity.
Email fraud with financial loss. If you have suffered a BEC (Business Email Compromise) attack, a supplier impersonation or CEO Fraud and need to demonstrate to your bank, insurer or the prosecution that you acted in good faith based on a manipulated email, you need an expert report that technically documents the impersonation.
Criminal complaint for identity theft. For an identity theft complaint to have judicial traction, digital evidence must be preserved with forensic methodology. A screenshot does not carry the same probative value as a technical analysis of the .eml file with documented chain of custody.
Employment disputes with emails as evidence. In labour disputes — dismissals, harassment, contractual breaches — emails are frequently used as evidence. For that evidence to be admitted and assessed in proceedings, it is often necessary for an expert to certify its authenticity and rule out alteration.
GDPR obligations after an incident. If your organisation has suffered a phishing or ransomware attack that has compromised personal data, GDPR imposes the obligation to notify the relevant data protection authority and, in many cases, demonstrate that you acted with due diligence. An expert report documenting the entry vector and the existing measures is part of that demonstration.
Civil proceedings with digital evidence. In civil cases where emails are relevant — agreements, communications, instructions — the party that needs to introduce them as evidence may require an expert to certify their integrity and authenticity.
Insurance claims. Some cyber insurance policies require technical documentation of the incident to process the claim. An expert report accredits what happened, how and with what consequences.
The difference between a technical report and an expert report
The difference is not one of technical depth — it is one of function and accountability.
A technical report describes what the analysis found. It is useful for understanding an incident, making internal decisions or documenting a case internally. It can be produced by an automated tool or a security technician.
An expert report is a document issued by a certified judicial IT expert, signed under their professional responsibility, with traceable methodology and a structure designed for presentation before a judicial or administrative body. The expert can be summoned to ratify the report in oral proceedings and to defend their conclusions before the court and the parties.
That difference is decisive when the report is to be presented before a court, a data protection authority, a prosecutor, an arbitrator or an insurer requiring formal technical documentation.
How the process works
The expert process begins with an initial consultation — explaining the case and providing the available material: the .eml file of the email, screenshots, conversation logs, contracts or any other related evidence. From there, the expert assesses the viability of the analysis and the scope of the report.
The analysis is carried out on the original material while preserving the chain of custody — the procedures that ensure the evidence has not been altered from the moment it was obtained to the moment it is presented. The resulting report documents the findings, the methodologies used, the evidence supporting them and the expert conclusions.
If the proceedings require it, the expert can appear before the court to ratify the report and respond to questions from the parties.
Automatic analysis and expert assessment: two different tools
ORTSLAB analyses messages in real time to detect risk indicators — sender authentication, domain reputation, social engineering patterns, malicious attachments. It is a prevention tool: it helps identify whether a message is suspicious before interacting with it, or to obtain an initial technical diagnosis after receiving it.
When the incident has already occurred and what is needed is documentation with legal validity, the next step is expert assessment. If you have an email that you believe may be key in legal proceedings, a complaint or a claim, the starting point is a consultation to assess the case and the scope of the analysis.