Help me not get fired, Metafilter!
June 10, 2014 3:17 AM   Subscribe

Some really horrible stuff was going down at work. I took absolutely no part in it, and even acknowledged that it may not be legal. I did this all over email, and even received responses back acknowledging this. I was explicitly threatened that if i wasn’t going to be a part of it, then i was to “forget about it or lose your job”. So recently, they all got busted. And like a bunch of cowards, they all blamed it on me. And because I’m the low girl on the totem pole, it looks like I might have been the one doing all this stuff (without ANY proof). But I have proof!

I’m very glad that metafilter taught me to “document, document, document!” when something shitty was going down at work.

So my problem is that I am going to have to go through about 10,000-12,000 (personal, not from my work address) emails from the last year to prove this. I am going in front of a “panel” at work, and it would be great if I was able to prove that I was not part of this mess. I want to show that the only way these people could have all ended up blaming me is because they actively conspired against me. I don’t want to “search” for keywords. I want to go through every individual email. EVERY SINGLE ONE. This is important to me.

What is the best email client for going though everything? I have all Apple stuff. I’d like to chill on my couch and go through everything on my iPad. But if memory is an issue, I can use my macbook pro, even my mac mini(at my desk).

I’d like to be able to download everything from the (imap) server, and then either print out stuff (probably necessary for the “panel”)or organize the stuff into separate folders about each issue, or something similar. So thats where I am. Kinda confused about what would make this Herculean task less hard.

I have always used Apple Mail, but it has at times been buggy. Also, I could go do this right now, but what stops me is looking at the setup, and realizing that I hate Apple Mail.

Can anybody help me keep my job?
posted by katventures to Computers & Internet (36 answers total) 12 users marked this as a favorite
Um..... get a lawyer before you do anything else. Seriously. Lawyer up then talk technical details.
posted by taff at 3:21 AM on June 10, 2014 [61 favorites]

The only thing I would do before engaging a lawyer, in this instance, is to make sure that you have your own backup of any email files on an offline backup form. Printing out is good. USB sticks also. Give a copy of anything to your lawyer and make sure that this transaction is time stamped. You are innocent and you are well prepared - so try not to worry; good luck.

- And don't rely on the neutrality and fairness of your internal work panel. The issue is too important.
posted by rongorongo at 3:40 AM on June 10, 2014 [30 favorites]

Yes, lawyer. Tomorrow. Do not try to do this on your own.

They are going to stick it to you you ten ways to Sunday on this if you don't have all your ducks in a row. I'd refuse to talk to anyone about anything until a lawyer has been consulted.
posted by empath at 3:40 AM on June 10, 2014

Yes, lawyer. Also make sure you have those emails copied into some form where nobody from your workplace can delete them.
posted by jon1270 at 3:41 AM on June 10, 2014 [4 favorites]

Thunderbird is a lot less awful than Apple Mail.
posted by flabdablet at 3:46 AM on June 10, 2014 [1 favorite]

Response by poster: I have a lawyer. He said that since the company had their own system of investigation, I should go through its motions...especially if I want those other people fired.

If they end up doing ANYTHING against me, then he will descend upon them like crazy.

So I have a lawyer. But what I need right now is to go through the emails. Please help me on that, please.
posted by katventures at 3:52 AM on June 10, 2014 [7 favorites]

Mod note: A few comments deleted. Okay, everyone, OP has a lawyer and is looking for the email solution now, so let's go ahead and answer that. Thanks.
posted by taz (staff) at 3:54 AM on June 10, 2014 [1 favorite]

As well as being able to copy stuff easily from IMAP folders to local folders, Thunderbird has a pretty robust threaded view mode that could be very useful for tracking through the relevant email back-and-forths.
posted by flabdablet at 3:54 AM on June 10, 2014 [3 favorites]

I'm not too familiar with the email clients, but my advice is to skip straight to a printer at home. Flip through the emails one at a time and print all the ones you need. On paper. Lots of it. Then make a copy.

Paper copies in your house can't be corrupted, deleted, modified or denied. Make sure they all print out with the date of printing on the bottom.

This will help if it comes down to you walking in with only electronic copies of emails that are mysteriously gone from the server or say something different. If these people are as nuts as they sound, a little bit of hacking, deleting and framing you for falsifying the emails doesn't sound too far off.

Oh, and forward a copy of the stack of emails to your lawyer's office. Have him time stamp them or save the envelope with the post mark.
posted by mibo at 4:03 AM on June 10, 2014 [5 favorites]

If you decide to use Thunderbird then here is a set of steps for making an offline backup of what you have.
posted by rongorongo at 4:04 AM on June 10, 2014 [4 favorites]

DevonThink Pro. Pay for the license.
posted by megatherium at 4:11 AM on June 10, 2014 [1 favorite]

I have done quite a bit of email archiving/documentation for legal reasons for my job. The format these people (the legal entity people) want to see everything in is .ost and print. For whatever reason, the Outlook format "legitimizes" it.

Get Outlook, set yourself up a folder for your special emails, and as you're searching dump all of the relevant emails into that folder. Export that folder as an ost file onto a flash drive. Then take that flash drive down to a FedEx and they will be able to print everything out (including attachments) easily and in one go.

Take your printed documents, highlight and tab the relevant areas, clip them together, attach the flash drive, and submit that.

It's the most formal way, and in my experience of actually having to use emails in legal proceedings, is how they want to see it presented.
posted by phunniemee at 4:41 AM on June 10, 2014 [44 favorites]

This may be overkill but why not use the tools that are available . I have been racking my brain ( and google ) trying to remember the tools that data journalists have been starting to use on email dumps. I seem to remember there being a great article explaining about tabula, refine , converting emails to structured data etc with the Snowden leaks. Cant quite find it yet but this tool may help sift through email as well; Muse

Even just converting your emails to a html page per email with full headers would let you go through them and print out more easily. Keep the original files as well. mhonarc
posted by stuartmm at 4:44 AM on June 10, 2014 [1 favorite]

Nthing that whatever format or tools you use to back up and compile the messages, you should make sure that you have the full headers - meaning not just the TO:, FROM:, and SUBJECT: lines but all of the server-related information that gets included with each message; this will contain very specific information about the date and time the message was sent, as well as where it was sent from. If the company has mail logs for this period then the headers can be used to corroborate your copies with server activity.

For example, here are the headers from a MetaFilter IRL notification I got not long ago (my actual address redacted):
Received: from ( [])
by (Postfix) with ESMTP id D1EE341E1610F
for ; Wed, 4 Jun 2014 00:01:08 -0700 (PDT)
Received: from ip-172-31-24-131 (localhost [])
by (Postfix) with ESMTP id 7F1FA60EAF
for ; Wed, 4 Jun 2014 00:01:08 -0700 (PDT)
Date: Wed, 4 Jun 2014 00:01:08 -0700 (PDT)
Message-ID: <1>
Subject: [MeFi Mail] IRL: New Event Near You
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Mailer: ColdFusion 9 Application Server
In Apple Mail (OS X Mountain Lion, anyway) you can get at the complete text of an e-mail by going to View -> Message -> Raw Source (Opt-Cmd-U).
posted by usonian at 5:36 AM on June 10, 2014 [10 favorites]

Ask your lawyer whether the industry-standard mbox-format text files that Thunderbird uses are an acceptable substitute for Outlook's proprietary PST binary blobs. If the issue is having access to the complete headers on every email, showing the exact set of servers they were sent through to get to you and all relevant timestamps, then all that stuff is in the mbox.

If mbox is OK on technical grounds, I would expect the maildir format used by Apple Mail to be so as well: it's very much like mbox, but with one file per email instead of having an entire folder's worth all jammed together in a single text file.

This being a hideously imperfect world, though, the issue might turn out to be making it easy for some tech-clueless jurist to open a copy of your mailbox with the only email client they think they understand. In which case, there are assorted converters available that will convert all your mbox or maildir files to PST without loss, any of which will cost you less than the frankly hideous Outlook.
posted by flabdablet at 5:52 AM on June 10, 2014 [1 favorite]

Ask Different is the best site for questions related to Apple hardware or software.

This thread for example is almost identical to what you are asking here. It describes how to archive your mail in order to make it searchable from Spotlight.

One thing it doesn't tell you is that you can type kind:mail in the search field to limit your results to email. You can also type things like or to:"Jane Doe" or subject:"illegal stuff" or date:"this month". (You can use several of these filters together using AND and OR words to connect them, () parenthesis to group the conditions, and the word NOT to negate a condition).

I wouldn't do 12,000 emails on my iPad.
posted by rada at 6:24 AM on June 10, 2014 [3 favorites]

Are their certain emails that you know you can get rid of? It might help to remove those to lower the number you have to go through. For example all emails from Ebay, paypal, your grandma, your bank, etc.
posted by Vaike at 6:27 AM on June 10, 2014

Thoughts on search strategy:

To Vaike's point, if you're looking to avoid brute-forcing it through 12,000 emails, start by limiting the universe to emails from senders at

Are there reports, listservs or other emails you know won't be related in this group? Eliminate the emails with subject including [TPS Report] or "Out of Office" etc.

Then you will at least have a significantly smaller corpus of content to work with.
posted by chesty_a_arthur at 6:36 AM on June 10, 2014

Yes, yes, yes make sure you have headers for these emails.

Keep in mind that your copies of these emails _should be_ just so your lawyer knows exactly what to request if it goes to discovery

If these people are as nuts as they sound, a little bit of hacking, deleting and framing you for falsifying the emails doesn't sound too far off.

I would not worry about this in the slightest. This is far, far more difficult to do convincingly and without leaving a huge forensic trail than is being suggested, and any lawyer would have a field day with missing evidence during the discovery process.
posted by bfranklin at 6:51 AM on June 10, 2014 [1 favorite]

I would not worry about this in the slightest

I concur. The chance of black hats at your company having access to your personal email provider's IMAP server will be slim to none.

That said, anything you care about should be backed up on media you can put your own hands on.
posted by flabdablet at 6:58 AM on June 10, 2014 [1 favorite]

For the iPad, I like Mailbox (although they are part of the Dropbox family, who I would like to be boycotting but haven't extricated myself yet). They do have some archiving/management features should you chose to use them, but just in general the interface is very satisfactory. It is iOS-only, so there is no desktop version.
posted by Lyn Never at 7:18 AM on June 10, 2014

I agree with phunniemee. There are two separate needs here: a) easy search through your archive; b) a big lump o'mail for legal protection.

For a) you can make an offline copy of an IMAP folder in something like Thunderbird (or its spinoff Postbox, which I like) but keeping track of threading can be fallible. Definitely make sure you retain full headers. For b) you probably need something in an Outlook format, and a stack of printouts.

So it may be easiest to get Outlook, copy the IMAP folders to local, search carefully with header-driven filters, not just keyword ones, and export them as a PST file.
posted by holgate at 8:13 AM on June 10, 2014

My advice for rapidly scanning your old emails is to use any email client with good keyboard navigation, and learn the keyboard shortcuts. For example, in Thunderbird you can press F or B to go Forward or Back one message, or N to jump to the Next unread message and T to jump to the next unread Thread. If you want to mark a message as important, just press S to Star the message, or a number key to apply one of your customizable labels.

Gmail and Outlook have similar keyboard shortcuts, as do most other full-featured mail readers.
posted by mbrubeck at 8:17 AM on June 10, 2014

Not a lawyer, but are you in a "right to work" state? The company may very well find that it's not worth their time to argue with you, and fire you anyway. I would not act with the assumption that they will be on your side, even though you are right and have the facts to back it up.

At this point, you may want to start talking with your lawyer to ensure that you won't suffer any legal repercussions for the thing that you are being blamed for outside of your own company.

I'm not entirely sure that your lawyer is taking this seriously enough, as it sounds like he's handling it as a routine employment dispute, rather than a set of people (who happen to be your coworkers) accusing you of criminal activity. That's a lot more serious than workplace finger-pointing.

As for some more general advice for the panel:
Keep calm. Do not point fingers, and rely on evidence rather than emotion. Let them make the accusations, and shoot down their arguments one by one. Don't turn this into a vendetta -- you have plenty of ammunition to make your accusers look like idiots if you calmly refute their accusations with concise and well-documented evidence.

Don't bother reading through the full stack of emails -- you'll look petty, and will dilute your arguments. Only provide the evidence that you need to make your case, and respond to specific accusations. If they push back, then open the floodgates, and layer on more and more evidence. Before the panel, organize the emails in such a way that you can quickly respond to specific accusations that they might make against you.
posted by schmod at 8:21 AM on June 10, 2014 [6 favorites]

You can use Mailstrom to sort your email by sender, subject, date, etc and move them in groups where you want them to be.
posted by ImproviseOrDie at 8:28 AM on June 10, 2014

Just one point in case you haven't thought about it:

You were apparently aware of illegal activity and didn't report it up the chain. You had good reasons, it seems, and you might be in more trouble if you did report it. But, fair or unfair, your bosses might treat you rough for this reason.

Something to think about as you position yourself.
posted by grobstein at 8:33 AM on June 10, 2014 [8 favorites]

EagleFiler is a mail-archiving program for the Mac.

It sounds like you want to import the whole kit & caboodle of your e-mail and extract stuff sent to/from the cabal at work. For that matter, you could do all that in itself, but if you want to separate your active mail from your archives, EagleFiler is probably the way to go.
posted by adamrice at 8:40 AM on June 10, 2014

For your technical problem, I would import all the data to Gmail and use their search tools. You can import into a brand new Google account if you want to keep the data separate. Gmail has a powerful search language that will quickly let you look for things like "all email from me to my boss that mentions the word fraud".
posted by Nelson at 9:36 AM on June 10, 2014 [1 favorite]

I use MailSteward for archiving giant mail archives of more than 500,000 messages. It looks old-fashioned, but it stays updated and works fine. It also allows complex searching.
posted by Mo Nickels at 12:31 PM on June 10, 2014

As for search strategies, do you have a good idea when this all started? If you explicitly stated in email that what they were doing is not ok, find your sent email first, then looks at everything two weeks before and after that event. When you get all relevant emails from that time period, extend it by two weeks before/after. Lather, rinse, repeat.

On preview: after a bit of searching, it may make sense to concentrate on date of your email up to present. Do you remember how long it took you to be aware of something hinky going on and sending your email?
posted by sfkiddo at 12:55 PM on June 10, 2014

Not a lawyer, but are you in a "right to work" state? The company may very well find that it's not worth their time to argue with you, and fire you anyway.

In addition to this, you acknowledge in your question that you knew something inappropriate was going on, and did nothing to stop it or make senior management aware of it, which might be cause for termination in and of itself.
posted by NotMyselfRightNow at 1:02 PM on June 10, 2014

I am a lawyer, not your lawyer, and have no legal advice for you. I can comment, however, on your plan to review thousands of emails. I want to suggest, based on my extensive experience reviewing emails, that you're taking on a lot of effort. It could take me two weeks (of more than 8 hour days) to get through that many emails. I don't gather from your question that you've stopped working full time or that you have a long time before the big meeting you're preparing for.

As a general matter, my advice is to work backwards rather than forwards. Don't start with the set of all emails, review them all, sort them all, and see where they take you. Start with the understanding that you have a meeting with this work panel, it's going to be limited in length, and you won't have the floor for the full length of the meeting. So, if your meeting is two hours long, you should expect that for part of the time, they'll be making introductory statements or summarizing issues that they are confronting you with. And, when you have an opportunity to speak, you'll have to spend some of that time answering questions and dealing with back and forth discussion. So you should conservatively plan on having only an hour to make your presentation to them, or half the hypothetical two hours I have speculated you may have with the panel.

If you have one hour (hypothetically - the general principle applies regardless of the actual length of time) then you are radically limited in how many different documents you can present to them. They're not going to be able to read and absorb hundreds, or even dozens, of emails. You need to limit what you show them so they can follow the story and not be overwhelmed.

So, for example, if I asked you right now to explain what happened, you might say something like this:

"Person A came up with the idea of Bad Thing. She emailed me and Person B about it. I was against it, and said so, but they were both excited. I tried to talk them out of Bad Thing, but they told me if I pushed against it or reported them, I would be fired. They included me on emails discussing starting up Bad Thing and I was also included on emails discussing the Bad Thing as it was happening, but as those emails reflect, I never participated in Bad Thing and never encouraged them to continue doing Bad Thing."

That's a simple story, and you only need a few emails to tell it - the ones referenced. Then you close by saying something like this: "I have thousands of emails with A and B, and a large number of them concern Bad Thing. The emails I showed you are only examples, and there are many more, all like the ones you saw."

If you want your presentation to the panel to be persuasive, nothing is more important than thoughtfully and strategically planning how it will be structured. By the way, I'm surprised that your lawyer was not interested in helping with that, but of course, than kind of help is expensive, so there are a lot of factors to weigh.

My strong advice to you, if you want to be persuasive and come across as polished, is to spend most of your time planning the outline of what you want to say and the points you want to make, then search (using keywords and date ranges) for specific example emails that support the points and assertions that you want to make. You won't win points for coming in with an armload of paper when you can get to the same place by showing them a dozen or so examples and saying, there's many more where than came from.
posted by prefpara at 5:10 PM on June 10, 2014 [22 favorites]

prefara gives good advice.
In the past, I have been in a very similar situation to yours. It turned out mr. IT in the organization was on my side, and he printed out 22 months worth of emails and made a digital copy - without my asking. Such a darling! It makes me think maybe someone can help you? Obviously, you need to research this very carefully.
posted by mumimor at 6:26 AM on June 11, 2014

Response by poster: Thank you to everyone for your suggestions/links/advice, and especially thank you for the tips which did relate to email clients and search strategies. This has been my first real interaction on MetaFilter and it's been so friendly and supportive, which I truly appreciate.

I am now feeling more confident about the panel, and have sought advice from a lawyer, friends in HR, etc. A lot of emphasis is being placed on conducting a full and fair investigation, so that my employer isn't at risk of a wrongful termination claim if they do decide to fire someone. This panel is an early step in a large investigation which now includes other people in my office too, and I'm hoping since I have concrete evidence that I'm not at fault, it'll be my LAST step.

I also think at least one of these people may have realised that there's an email trail implicating her, because she's since changed her story and has been trying to distance herself from the others.

My main source of panic has been the overwhelming amount of information I need to sort through. Thanks to the suggestions here it's looking manageable now. But my inbox is in general disarray and I'd like to keep on top of it from now on (for the next time I'm falsely accused of something, I guess?) so if anyone has any other suggestions please keep them coming!
posted by katventures at 3:25 PM on June 11, 2014

Learn to use your email client's search facilities to the full extent of their ability, which will typically be very good.

Computers are much, much better at searching for things than people are at keeping them tidy. This is a lesson that Gmail taught me, and it stuck, and it still works fine for me even since dumping Gmail.
posted by flabdablet at 7:18 AM on June 13, 2014

But my inbox is in general disarray and I'd like to keep on top of it from now on (for the next time I'm falsely accused of something, I guess?) so if anyone has any other suggestions please keep them coming!

General email organizing tips? I've got that.

First: Make archive folders. I have a bunch nested under "ARCHIVE", and they include Friends & Family, Work (Work Sub 1, Work Sub 2, etc.), Expenses, Accounts, and other categories. If you prefer, you can just have one giant archive folder to hold everything and rely more on search skills to find stuff later, but I have an easier time finding emails when I can narrow it down to categories.

Optional: make PENDING and RESPOND folders. PENDING holds all the emails related to a current project, expected deliveries, etc., and gets pruned every week. RESPOND holds emails you'll respond to later (ideally, at a designated time - I do mine right before lunch).

Keeping up with current email: Pick specific times of the day to process your new emails. For each email, choose one of the following:

-Is it urgent or can it be done/responded to in less than 2 minutes? If so, do it, then move the email to PENDING or ARCHIVE.
-Is it not urgent and will it take longer than 2 minutes? Defer it for a later response (i.e., move the email to RESPOND and respond later during a designated time) or put it on your to-do list and move it to PENDING.
-Delete it.
-Archive it.

Dealing with the backlog: same process as above with a lot more archiving, done in bite-size time chunks. You can make this go faster by sorting by sender or keyword and moving emails in large batches.

Sorry you're in this situation. Good luck.
posted by moira at 2:07 PM on June 13, 2014 [1 favorite]

« Older Should I continue pursuing her?   |   Can you answer this question before my traffic... Newer »
This thread is closed to new comments.