Someone is claiming to have sent me an email to my Hotmail account. I never received this email. They have forged an Outlook email showing the date and time that it was sent. How can I prove that their claim is forged?
closed as off-topic by Xander, Bryan Field, D.W., Dmitry Grigoryev, Rory Alsop♦ Sep 26 '16 at 16:40
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "This question does not appear to be about Information security within the scope defined in the help center." – Xander, Bryan Field, Dmitry Grigoryev, Rory Alsop
The SMTP logs of Hotmail, their provider or any trusted third-party involved in delivering the email could confirm if their servers did or did not process it. (There is no guarantee that logs are available and likely you won't be given that information without a court order.)
But either way you won't be able to prove that they forged it. That's because there are plenty of ways an e-mail can get lost. It might very well be an accident and from their point of view it's equally hard to prove that the email has actually been sent.
It is like with snail mail: you cannot prove that somebody did not send something to you. It might have been that the message was send but got lost. Or in the case of e-mail you might have accidently deleted the message, it might have been marked as spam or the mail server might have dropped it because it looked too much like spam or because of malfunctions at the server.
It sounds like you are having or considering a legal dispute. I very much doubt that there is any legal regime in which an ordinary, vanilla, email message satisfies any legal or contractual obligation relative to official notice of anything. Thus, it doesn't really matter if they typed it in and pressed send, or not. If they claim that they officially notified you of something, they are just wrong.
The analogy between emails and postcards not only works with respect to privacy, but also with respect to reliability: Most of the time they get to their recipient, but there never is proof. Nor can anyone prove they sent a postcard/email. Email alone is simply not capable of being used for legally bound communication. It is even easier to fake than postcards (until digital signatures are involved).
Mail just gets lost, it happens. The original SMTP protocol argues that in case a relay cannot forward mail it shall do a best effort to notify the sender. But thanks to the amount of spam today, not even this is followed since it would allow spammers to scan for valid email addresses.
As far as mail tracing is possible the sender (the guy who argues that has sent an email to you) can prove that their email left their MTA and arrived at the next hop. He can do it by providing logs from their MTA. For example, my postfix sending email to someone at google would log this (all on a single line):
Sep 20 00:30:22 orion postfix/smtp: AC9A7C5F: to=<***@***.com>, relay=smtp.gmail.com[18.104.22.168]:587, delay=1.5, delays=0.02/0.04/0.44/1, dsn=2.0.0, status=sent (250 2.0.0 OK 1474341452 u185sm18955035amu.20 - gsmtp)
This means that gmail accepted this message. Of course, such a log can be forged, it is just a piece of text that belongs to the guys that wants to prove that the email was sent.
But now that ball is in gmail (or hotmail's, as in your case) court since they should log that that email was accepted by their server. It may not be easy to get those logs from hotmail (or gmail), it is unlikely that they would want to give them for free or without a judicial order.
In summary, it is possible to track what happened to an email based on MTA logs. But that requires access to all mail relays that the mail went through (and a good deal of resources to achieve that). It is like with the snail mail analogy: you can go around all the streets that the postman went through and ask people in their residences whether the postman passed through the street in the last week. But just like with people you may be unlucky and someone may not want to talk to you or have forgotten (erased the MTA logs).
To show an sent e-mail is by no means proof that the person received it for several reasons.
- May be a forgery. Most email clients allow printing the unsent email in the outbox as if was actually sent.
- The email could be lost in the the way. Any server between your accuser and yours may have misplaced the email.
- Hotmail could have swallowed the e-mail. Hotmail is not nearly flawless.
- It can have be marked as spam. Anti spam software is not as intelligent as we want.
- You can have deleted it without reading it. It can happen with anyone.
There is many things to go wrong. That is why sending a single email without asking for confirmation is the weakest of the evidences.
As someone said you can contact Hotmail asking for the confirmation, but usually this is an overkill. Just state that you did not received it, that should got lost between their server and Hotmail or flagged by hotmail as spam. Ask to be sent again to see if you will receive the next one.
If they are charging you without reiteration or trying to contact you some other way they are excessive in my opinion.
You haven't indicated what this proof of sending is about and so we can't comment on the risks and impacts.
However, just to be very clear. Showing you some text does not constitute "proof" in any way. So if there are legal implications you can simply say thanks politely and state that you did not receive it, you've checked your spam folder & searched. And state that the "evidence" cannot be accepted as proof.
If this were important, the sender should have asked for a receipt in the form of a return email. If they didn't get that, they should have sent a registered letter, e.g. one that requires your signature as proof of delivery.
As a little historical light relief, this is exactly what FAX was good for as it was established that the FAX receipt was suitable legal proof that the FAX was received. Most Email systems do not have this level of proof built in though X.400 systems can do so.
Another factor here: I have had trouble with Hotmail swallowing email from certain domains. I've never seen it do it to a big guy, but with amateurs in charge, or with ISPs in China it can be a problem. I think it's a matter of being automatically dumped if the sending server isn't configured perfectly. (DNS records matching the server, the incoming mail coming from the IP that the records say it should come from.)
Whitelisting such a sender does nothing to avoid this and the offending messages simply vanish, they don't go to spam. The sender is not notified of the failure.
Perhaps the offending message vanished this way.
Proof must come from both sides. The sender must prove they sent you one. In the sender email's server, an administrator can prove an email went out by the header information in the email, and it went to the right email address and email server. Once that is proven, the receiver server admin can check what happened on the receiving end. There will be information in the email header information on where it went, why it was rejected, or that it's waiting to be received, it will also show if it was delivered to your mailbox.
If your system did not receive the mail, there is no real evidence to support this.
Possibly have the sending user verify the email sent successfully through their logs.
You probably did receive it -in the spam section.
Try to send them a screenshot of the emails (be careful with your information) you received that day or date & time with the same way they did.
Very simple, if the e-mail was that important it should have being sent to you with a delivery and read receipt, ask them for those receipt as the proof for the e-mail going out. If an e-mail is that important, we don't send it without those receipts precisely to proof it was sent.