Hacker News Reader

Comment by Infernal | Hacker News Reader

I’ve always wondered about tampering of digital evidence like that, how much it might happen and not be detected, and what the penalty would be if it were.

View on HN

Part of the work was explaining that a print out of an email is just a representation of the email, an actual email contains headers (like a digital stamp) that explain how the email got to where it is (in gmail -- "show original" -- that naming really helped, btw) and without it, you just have a piece of paper with words on it. The equivalent would be printing out the body of a newspaper article without the author or source. You have words, but you can't prove that it came from that newspaper unless someone else can corroborate it.

Email has been around long enough that it's hard to imagine someone submitting an email as evidence without including full headers. Do you think that it was done intentionally to trick the court or was it just incompetence?

As best as I can recall, Outlook for the Mac doesn’t have any way to see the full headers. I’m skeptical many people know the headers exist.

Good point! It used to be possible in outlook, but it looks like MS took that option away for years (WTF). Recently (within the last year) they said they brought it back. In Outlook 365 for Mac you should be able to right click on a message and select "View Source" to get the message with the full headers. That's the same way people did it in Outlook for Mac 2011

I agree, most people have no idea headers exist (beyond the short headers), but I expect lawyers and law enforcement to know better. Handling digital evidence is not new and at technology's timescale email is ancient.

You can but it is clunky. Save the email out as an .eml file and open it in an editor. You see all the headers.

It costs money and attention to insist on full headers. Unless the lawyers think there's something worth digging for, technical details would be omitted from copies just like they are in your email GUI.

And, on the other hand, either party can demand the other prove via live witness that the evidence is authentic, reliable and useful. If the witness isnt credible, the document can be excluded.

For reasons I can’t go into detail, but it was intentional and incredibly stupid.

Knowingly submitting fraudulent evidence is considered a pretty bad idea. Regardless if it is analog or digital.

Reply on news.ycombinator.com