Comments on: Can you tell if emails in an Outlook file have been falsified?

Question: Can you tell if emails in an Outlook file have been falsified?

mikeand1 — Sat, 02 Dec 2006 21:58:36 -0800

How can you tell if emails in an Outlook .PST file have been falsified?

Suppose somebody sends me an Outlook mailbox (i.e. a .PST file). I want to know whether they falsified an email in that mailbox.

For example: They send me the Outlook mailbox. It contains an email that the mailbox owner received on January 1, 2004. I can see the body of the email, the date received, date sent, the message ID, and so on.

However, how do I know the body of the email has the same text as the email that was originally received? For example, in Outlook, you can edit an email you receive to change the text of it. You can edit it long after you actually received the email to make it look like someone sent you an email saying X, when they really said Y.

Can I tell if an email has been edited in such a fashion just by looking at something in the Outlook mailbox (.PST file)? (For example, in Word I can look at the "Properties" of a Word document and see when it was last saved.)

Or do I need to get logs off their email server or somesuch?

thanks,
Mike

By: phrontist

phrontist — Sat, 02 Dec 2006 22:31:05 -0800

A sufficiently savvy user could definately alter it in an untracable way. I don't know if PST's do any sort of revision tracking.

By: oats

oats — Sat, 02 Dec 2006 22:37:34 -0800

Unless the mail was cryptographically signed (and generally crypto signatures are pretty obvious), no.

The 'last saved' bit in Word docs is also trivially falsifiable with the most basic of file manipulation tools.

By: RichardP

RichardP — Sat, 02 Dec 2006 22:47:23 -0800

do I need to get logs off their email server or somesuch?

Even this wouldn't help you. Few, if any, of the popular e-mail server packages record message contents to their logs.

By: flabdablet

flabdablet — Sun, 03 Dec 2006 00:27:08 -0800

You do it by contacting the sender, and asking for a copy of the mail that they sent to X on such and such a date at such and such a time.

Even then, they could be in cahoots.

By: event

event — Sun, 03 Dec 2006 06:11:45 -0800

There is no way to tell. As oats said, a cryptographic signature is really the only thing that would help here, and without that, you're out of luck.

By: mikeand1

mikeand1 — Sun, 03 Dec 2006 08:47:22 -0800

Well let's narrow down the possibilities then.

Suppose the person who sends the Outlook mailbox with a falsified email does the simplest thing possible: Before sending the mailbox to you, they go into Outlook, open the message they received, and simply use Edit -> Edit Message to edit the body of the message. They save the edited message and then send the whole mailbox to you.

Is there a way to detect such a change?

By: flabdablet

flabdablet — Sun, 03 Dec 2006 16:15:25 -0800

I don't know, but I know how I'd find out.

I'd send myself a mail containing many copies of an unlikely word like florbleglast. I'd use Outlook to edit the mail and change all the florbleglasts to flubberworths, then open the .pst file with a hex editor to see if there were any florbleglasts still inside it (or even if there was a complete copy of the original, unedited mail). I'd then have another look after running a Compact Mail Folders from Outlook.

By: mikeand1

mikeand1 — Sun, 03 Dec 2006 17:24:33 -0800

^^^ That's an excellent idea. Unfortunately, my mailbox is already full of florbleglasts and flubberworths... Damn you spammers!!!!

j/k

Thanks flabdablet, I'll give it a try.