How to check authenticity of forwarded email

HCL Domino Domino Forum
1

Hi - I’m not sure if we can prove this out as a definite but we have a request from our HR to validate a forwarded email. It seems a particular user keeps “complaining” that his emails are not reaching their destination (his boss). When the boss asks him for the email, he sends a “forwarded” version that looks legit but we all know how easily they can be faked.

I’ve checked the users mail file and there is no original document saved with the original date and time so unless he forwards the original email and then deletes it, he’s probably fabricating the entire forwarding chain. Can anyone assist? Are there other things we can check on the forwarded email? These are both internal users and are each on a different mail server. Thanks!

2

Subject: How to check authenticity of forwarded email

There are some things you can check, but I doubt any of them are foolproof…

Just looking at my own “Sent” view, forwarded messages seem to have a few extra fields that other messages don’t.

e.g. $RFSaveInfo, ForwardedDate, ForwardedFrom.

If any of those fields are missing, the “forward” could be faked, but…

Note that some messages I sent about 3 years ago don’t have the $RFSaveInfo field, so that may vary depending on the Notes version.

If the user who claims to have sent the original can provide a date and time when they did so (say down to the nearest 10 minutes), you can check Mail Routing Events in the mail server’s log database (log.nsf) to determine if they really sent mail to the same recipient at about the same time.

Here’s some content from my company’s mail log, with names “anonymised”…

14/02/2007 03:34:21 PM Router: Transferred 1 messages to SERVER/DOMAIN via Notes

14/02/2007 03:34:21 PM Router: [00000005] Transferring mail to SERVER/DOMAIN via Notes

14/02/2007 03:34:26 PM Router: Message 00191994 transferred to SERVER/DOMAIN for Recipient Name/domain@domain from Sender Name/domain Size: 5K via Notes

That was for a message I sent to a user with their mail file on a different server to mine.

Here’s a simpler one, sent to a user whose mail file is on the same server as the sender’s…

14/02/2007 02:47:53 PM Router: Message 0014D59B delivered to Recipient Name/domain from Sender Name/domain Size: 1K Time: 00:00:00 Hop Count: 1