SITUATION
Our client received an email with an attachment. The received email was later forwarded by our client to an outside 3rd party. That party alleged that our client modified the email attachment prior to forwarding the email to them.
OBJECTIVE
We were asked to review the email communication chain and associated attachment to determine if any modification was made to the attachment.
ANALYSIS
We began the process by performing a targeted email collection of our client’s email account. Meaning, we only collected the emails messages relevant and in scope. Upon successful acquisition of the emails, we proceeded to review the various attachments and email messages. Our first objective was to calculate digital fingerprint values of the email attachment found in the email message received by our client. Next, we applied the same digital fingerprint process to the email message and attachment forwarded to the 3rd party.
RESULT
After comparing the digital fingerprints of the attachment received by our client and forwarded to the 3rd party, we were able to show that both attachments had the same digital fingerprint values. Therefore, no modification of the attachment was done prior to forwarding the email message.
