7

I tried to access an old E-mail to print for a court case only to find there is no content. I checked on all my devices and outlook account. The E-mail in question is from a gmail user and I have subsequently learned there are ways to get the content to self destruct. This single, most damning E-mail is the one that is missing its message content.

Is there a way to analyse the header to determine if there was some self destruct/expiration setting. For clarification, this was not an attachment, but a body of text that appeared as a normal E-mail message from the sender.

  • 12
    Email messages do not self-destruct, but they could be linked to external resources one way or another that do. The simplest example would be to send you an image tag, which links to a website, that represents the full message. That image could get removed from the website beyond your control. – Julie Pelletier Jul 24 '16 at 4:28
24

Emails, sent through SMTP, have no way of "self-destructing" internally built in to them. They're basically just text files that hang around for eternity until all copies are manually deleted. The fact that you still have the email's headers is proof enough; if messages could self-destruct, their entry would be entirely removed from your mail client, as if they never existed.

However, there is a way to destroy the body of an email: simply have the email point to an external inline image, then later delete the image. In short, the body of your email might look like this (HTML sourced):

<img src="http://www.example.com/message-images/012345.jpg" />

Thus, when you first open the email, your client displays the image, which appears to be just plain text to a layman. The only obvious hint that it is not text would be that you can't "copy and paste" it, but it'd still be printable, etc. Some clients will warn you about inline images, because that itself is a security risk (at minimum, you can presume that the author now knows you've opened or scanned the email).

Finally, the author simply needs to delete the original image file. Once deleted, clients would probably display nothing or perhaps a "broken image" icon. Alternatively, they could switch the image out for a 1x1 transparent pixel, which would render as... nothing.

You could, however, view the source of the email (see your client's help documentation on how to do this), then find the image link, as described above. From there, you might do a Google search; if it's cached by Google, you might be able to recover the source from there. Of course, if the image was hosted without a domain name (e.g. stored by IP address), you might be entirely out of luck.

|improve this answer|||||
  • 2
    Maybe also things like an <iframe>? – UniversallyUniqueID Jul 24 '16 at 14:14
  • 12
    There's no way Gmail is loading iframes in emails. The CSP directives, for a start, would prevent it. – Polynomial Jul 24 '16 at 15:04
  • A better alternative: disable rendering of external images. – Ángel Jul 24 '16 at 19:37
  • Google downloads embedded images from third-party sites and saves them on their own servers in order to avoid various security and privacy (moreso Google's privacy than yours) issues with such links, so I doubt that's what happened. – R.. GitHub STOP HELPING ICE Jul 24 '16 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.