There was an issue and my employer asked me to forward the email that I sent out to a client a few days prior. The email contained 3 PDF attachments and I immediately sent this to my manager. I am being accused of replacing one of the PDFs with an altered or new PDF file in the email that I sent to my manager.

Of course, I did not do this.

Is there any way to track the activity on my computer or help to prove my innocence? I've heard of "keystroke monitors" on servers but I don't believe my organization uses such monitoring.

We use a remote server and we do not have Microsoft Exchange.

  • Are you being accused of giving your clients and your boss different attachments, or of modifying the attachments sent to both the client and the boss, or what? Clarity is important. Also, what was the source of the PDFs originally; can you use that source to demonstrate that the one you sent is unmodified? Finally, you say you use "a remote server", but what kind of server is it (for example, an IMAP server probably stores copies of all sent messages) and who controls it (i.e. could anybody have tampered with the messages it stores or sends)? – CBHacking Jun 28 '18 at 7:16
  • I am being accused of giving different attachments to boss and client. We call our server a VDI and that is all I know. Thank you for your time and consideration – Fairbanksash Jun 28 '18 at 12:46
  • Are your files on the VDI too, or just applications? And were the files altered trying to cover something up or was it a matter of different versions? – Nomad Jun 28 '18 at 20:38
  • 2
    It is difficult to prove that you did not do something. I'd ask why they think the PDF was altered. – schroeder Jul 11 '18 at 10:44
  • Instead of proving the consistency of the email, why not get the "altered" document and the "original" document and compare their meta data. – Anthony Russell Jul 11 '18 at 10:59

Is there anyway to ... help to prove my innocence ...?

Ask your client to send an Email send the email to your employer, if you can.

In the future you can confirm that the Email is unchanged by automatically signing your Emails with SSL certificate. There are a lot of providers of affordable certificates. In the popular Email clients like MS Outlook there is functionality that allows you to automatically sign every Email you send. So you can at any time in the future show, that any of your Emails remains unchanged.

  • Signing an email only proves the content of the email - not the headers (i.e. not the recipient, date, from address...) so if the OP possessed a signed email, the signature would not prove the OPs innicence - OTOH if the recipient had a signed email containing the allegedly tampered-with file, this would tend to prove the OPs guilt - and that's where things start getting complicated. If this is a work machine, then there can be various backdoors by which someone other than the OP could have used the certificate. – symcbean Jul 11 '18 at 11:18

Your Sent Email folder will have the original. There may also be copies on the email server itself. Ask someone from the IT department or the email admin to verify either your Sent folder or the server copies.


I am being accused of giving different attachments to boss and client.

This helps a lot in clarifying the story.

Did you add the 2 recipients to the same email? If so, then there are at least 3 copies of the email - one in your sent items, one in your boss' inbox and one in the client's inbox. While it is unlikely that the mail server will retain copies of the email, it may contain other information such as the size of the message in its logs. Your boss is asserting he received something different from the client - it should be trivial to check this.

In the absence of digital signatures (but see comment elsewhere) it is possible to modify an email in transit, and to change stored content.

But we are assuming that there are no signatures - it is good practice to use DMARC for mail messages - and if your company are paying for a dedicated email service, then I would hope the provider is following good practice. If the emails received by both the client and the manager went through such a server, the content would have been signed.

It sounds like this seems to be a fight between you and your boss at the moment - but depending on your jurisdiction there may already be legal ramifications. If I were in your shoes, I would be trying escalate the matter as far possible now - preferably out of the hands of any investigation by your employer.

In the absence of a single email with 2 recipients or DMARC then we can't really say if there is sufficient information captured elsewhere to establish the truth of the matter (or even the balance of probability). But it seems reckless for your boss to make such an assertion without reason that there was evidence to support his claim - and you've told us nothing about that.


The only reliable way to prove what you have sent is to include a logging BCC address in the message. If that logging account is managed by the IT department, you can ask them to extract a copy of the message, that will be timestamped by the mail server. This along with the mail server logs can give an evidence of what was sent, at what time and what were the recipients.

In the absence of authentication on the mail server, that would only prove that your mail address was used, if the mail server requires an authentication, this would also prove that your account was used, but only a smart card signature would prove that you have sent that.

Ok this is the ideal use case, unfortunately, such logging BCC are uncommon, but it is easy to mimic them by adding your manager as a BCC to all important mails that you send. I will assume now that nothing of that have been used here.

As you can easily modify your local mailboxes, you cannot really rely on them to prove what you have done. At best, you can show their content, but your manager will be free to trust you or not. Things can be better if your mailboxes (including the sent messages one) are hosted in the mail server (can be common in IMAP mode). If you can only use SMTP or IMAP to access them, then you cannot easily tamper a message, or at least the server logs could have kept traces. In that case, the IT department could tell your manager whether according to their logs and knowledge it is likely that you could have changed the message or not.

I must acknowledge that this is not a very precise answer. At least it gives some hints on some places you could search for evidences. But if your sent messages are only kept on your local machine, unless you can prove that you have neither the tools nor the knowledge to modify the local mailboxes it will be very hard to prove anything, except by asking the client to send back to your manager the mail you had sent them. Unfortunately it may or not be possible depending on the client policy rules of your organization.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.