Proving a forwarded email attachment was not modified

Question

There was an issue and my employer asked me to forward the email that I sent out to a client a few days prior. The email contained 3 PDF attachments and I immediately sent this to my manager. I am being accused of replacing one of the PDFs with an altered or new PDF file in the email that I sent to my manager.

Of course, I did not do this.

Is there any way to track the activity on my computer or help to prove my innocence? I've heard of "keystroke monitors" on servers but I don't believe my organization uses such monitoring.

We use a remote server and we do not have Microsoft Exchange.

Answer 1

Is there anyway to ... help to prove my innocence ...?

Ask your client to send an Email send the email to your employer, if you can.

In the future you can confirm that the Email is unchanged by automatically signing your Emails with SSL certificate. There are a lot of providers of affordable certificates. In the popular Email clients like MS Outlook there is functionality that allows you to automatically sign every Email you send. So you can at any time in the future show, that any of your Emails remains unchanged.

Answer 2

Your Sent Email folder will have the original. There may also be copies on the email server itself. Ask someone from the IT department or the email admin to verify either your Sent folder or the server copies.

Answer 3

I am being accused of giving different attachments to boss and client.

This helps a lot in clarifying the story.

Did you add the 2 recipients to the same email? If so, then there are at least 3 copies of the email - one in your sent items, one in your boss' inbox and one in the client's inbox. While it is unlikely that the mail server will retain copies of the email, it may contain other information such as the size of the message in its logs. Your boss is asserting he received something different from the client - it should be trivial to check this.

In the absence of digital signatures (but see comment elsewhere) it is possible to modify an email in transit, and to change stored content.

But we are assuming that there are no signatures - it is good practice to use DMARC for mail messages - and if your company are paying for a dedicated email service, then I would hope the provider is following good practice. If the emails received by both the client and the manager went through such a server, the content would have been signed.

It sounds like this seems to be a fight between you and your boss at the moment - but depending on your jurisdiction there may already be legal ramifications. If I were in your shoes, I would be trying escalate the matter as far possible now - preferably out of the hands of any investigation by your employer.

In the absence of a single email with 2 recipients or DMARC then we can't really say if there is sufficient information captured elsewhere to establish the truth of the matter (or even the balance of probability). But it seems reckless for your boss to make such an assertion without reason that there was evidence to support his claim - and you've told us nothing about that.

Answer 4

The only reliable way to prove what you have sent is to include a logging BCC address in the message. If that logging account is managed by the IT department, you can ask them to extract a copy of the message, that will be timestamped by the mail server. This along with the mail server logs can give an evidence of what was sent, at what time and what were the recipients.

In the absence of authentication on the mail server, that would only prove that your mail address was used, if the mail server requires an authentication, this would also prove that your account was used, but only a smart card signature would prove that you have sent that.

Ok this is the ideal use case, unfortunately, such logging BCC are uncommon, but it is easy to mimic them by adding your manager as a BCC to all important mails that you send. I will assume now that nothing of that have been used here.

As you can easily modify your local mailboxes, you cannot really rely on them to prove what you have done. At best, you can show their content, but your manager will be free to trust you or not. Things can be better if your mailboxes (including the sent messages one) are hosted in the mail server (can be common in IMAP mode). If you can only use SMTP or IMAP to access them, then you cannot easily tamper a message, or at least the server logs could have kept traces. In that case, the IT department could tell your manager whether according to their logs and knowledge it is likely that you could have changed the message or not.

I must acknowledge that this is not a very precise answer. At least it gives some hints on some places you could search for evidences. But if your sent messages are only kept on your local machine, unless you can prove that you have neither the tools nor the knowledge to modify the local mailboxes it will be very hard to prove anything, except by asking the client to send back to your manager the mail you had sent them. Unfortunately it may or not be possible depending on the client policy rules of your organization.