Best format to provide archived emails to a lawyer - old thread; solved.

DoaM

Print to PDF the EML files?

Then update your master PDF to hyperlink to the new PDF files for easy access?

(Keep the original EML files as reference in case they're needed in future).

That's probably the easiest way to make the information clear, understandable, and free from corruption.

arciere

DoaM wrote: »

Print to PDF the EML files?

That, in a way, is not much different than a plain text file. It 'shows' you the information, but it's not the original file and could be very easily faked.
Back to the problem, I think that the best thing to do would be to ask what format they expect the emails to be. If they say .msg, for example, there are lots of converters online that could convert your .ems to a .msg file (or to whatever format suits them).
EDIT: Or, even better, why don't you just forward them all the emails as attachments? This will keep the original data and formatting and should be compatible with pretty much any email program.

glennevis

.eml is not a universal format. Plain text or PDF are accepted document formats. You should not massage the data if you want it to be used in evidence.

For forensic purposes use the 'show original' option. The option may have a different name depending on the email client you use. This will display the actual content of the email as received including full headers.

Emails are transmitted as plain text 7-bit ASCII with any original fancy formatting converted to 7-bit using MIME encoding (Google it). Your chosen email client decodes these characters so you get to see fonts, embedded images, attachments, etc.

Save each individual email as a .txt file which can be viewed in Notepad (e.g. if using windoze).

And, yes, I have had to produce such evidence for a legal case when I used to administer email servers. I've been retired for a few years but the standard has been in use since 1982.

BooJewels

DoaM wrote: »

Print to PDF the EML files?

Then update your master PDF to hyperlink to the new PDF files for easy access?

(Keep the original EML files as reference in case they're needed in future).

That's probably the easiest way to make the information clear, understandable, and free from corruption.

I was trying to put them into pdf files by different methods - but I totally forgot about printing to pdf - thanks for that - it might well work.

Steve_KK

I have worked in eDiscovery and been and expert witness on a case (although it never went to court), so I do have relevant industry knowledge.

Depending on the court and level of proof required you will need to potentially engage a specialist who understands how to capture email data in a defensible way and will follow standards to ensure that another expert in the field could follow the same procedures to capture and secure the data.

Sending the EML files on a CD ROM is reasonable as the CD is a read-only format. However I would suggest that metadata related to the email is preserved. The metadata will include information that usually isn't visible within an email client, which an eDiscovery/Forensic IT expert can examine to determine the validity, or otherwise of an email. If the opposing party claims the emails are fake you want to be able to defend them.

Ideally you would want an expert to capture all the data from your email server - if this is something like gmail, Hotmail or O365 the expert should have no problem doing that once you've shared credentials with them (I would recommend changing these once they've captured a copy of the data). They will make sure that all available metadata is captured and all email is secured in a format that cannot be modified. They would also be the best people to provide the relevant emails to your solicitor in a format that they can access.

Unfortunately many solicitors still only understand paper as a format for documents and will still request that provided documents are printed. Again this will likely be missing metadata, but working with an expert will ensure the metadata isn't lost.

Hopefully this helps a bit.

Regards,
Steve

BooJewels

arciere wrote: »

That, in a way, is not much different than a plain text file. It 'shows' you the information, but it's not the original file and could be very easily faked.
Back to the problem, I think that the best thing to do would be to ask what format they expect the emails to be. If they say .msg, for example, there are lots of converters online that could convert your .ems to a .msg file (or to whatever format suits them).
EDIT: Or, even better, why don't you just forward them all the emails as attachments? This will keep the original data and formatting and should be compatible with pretty much any email program.

There are 140+ emails and counting. To send them as an attachment, you'd still need to save them as a file and if you forwarded them, then that would be changing the headers of the original email. I know, because I tried that a day or two ago, trying to find out when a particular message was sent from a saved source we had.

It looks like they use Outlook, so .msg will be the format they'll need to open emails as they were received. At this stage, they only need to read the content to get context of what has been said and the summary pdf I created is good enough for that purpose - she's now managed to find that. It's not like a criminal trial where proving what computer generated an email might be important, it's what was said and by whom that matters at the moment.

She tried opening the .eml files whilst we were on the phone and it just said Windows would need an additional extension to open the file and she's not allowed to install anything. So I'll see if I can get an appropriate converter and save them as .msg files.

glennevis wrote:

For forensic purposes use the 'show original' option. The option may have a different name depending on the email client you use. This will display the actual content of the email as received including full headers.

That certainly works (if you copy from the message source, which has the code for formatting etc) and for forensic examination it might be necessary, but I think for this purpose (at worst it will go to a tribunal) the header information would cause confusion and make it harder to disseminate the information required - where at the moment, stuff italicised and in bold etc. might be more pertinent for interpreting meaning and context etc. I just tried one message with a modestly sized attachment and it ran to over 900 pages of printable content, so attachments would need to be excluded etc., thereby removing some of the advantage.

BooJewels

Steve_KK wrote: »

Depending on the court and level of proof required you will need to potentially engage a specialist who understands how to capture email data in a defensible way and will follow standards to ensure that another expert in the field could follow the same procedures to capture and secure the data.

Thanks for the details. We were obviously typing at the same time - I was just saying that these don't need to be forensically substantiated at the moment - the solicitor just needs to be able to read them in context - but as I summarised them into a pdf in chronological order, at this stage it will be good enough for her to get a feel for the potential of the case and any course of action we might be able to take - it'll be an Employment Tribunal - it's not a criminal case. In fact, we sincerely hope that we can secure some sort of resolution long before that would be necessary, I really don't want to drag this out any longer than absolutely necessary.

I just wanted to give her the option that if she read something in the summary, she could open the associated email and see it in the original context. I wanted her to be able to substantiate my work, rather than the forensics of the emails - she has to know that I've been honest in my transcribing of that data into a summary, so that she can trust it as she reads.

At this stage it was just a nicety for her ease of working. And generated by her emailing me saying she couldn't read any of the emails - largely as it transpires - because someone else had saved the summary chronology document in a different place from where I said it was in my explanation of the organisation of the data.

arciere

BooJewels wrote: »

There are 140+ emails and counting. To send them as an attachment, you'd still need to save them as a file and if you forwarded them, then that would be changing the headers of the original email. I know, because I tried that a day or two ago, trying to find out when a particular message was sent from a saved source we had.

I see, unfortunately I don't use Thunderbird, with Outlook you can simply click&drag an email into a new message and it gets saved with its headers intact.

Steve_KK

BooJewels wrote: »

There are 140+ emails and counting. To send them as an attachment, you'd still need to save them as a file and if you forwarded them, then that would be changing the headers of the original email. I know, because I tried that a day or two ago, trying to find out when a particular message was sent from a saved source we had.

It looks like they use Outlook, so .msg will be the format they'll need to open emails as they were received. At this stage, they only need to read the content to get context of what has been said and the summary pdf I created is good enough for that purpose - she's now managed to find that. It's not like a criminal trial where proving what computer generated an email might be important, it's what was said and by whom that matters at the moment.

You could copy the emails to a PST file that you attach to your Outlook client. The solicitors would then be able to do the same after copying off the CD/DVD on which you sent them. I believe this will preserve the metadata and provide a more flexible way of viewing them.

Having said that they will still probably give them to a junior and asked them to print in date order!

Regards,
Steve

BooJewels

I don't have Outlook unfortunately, hence using Thunderbird and having this issue in the first place. I don't even know how much it costs, not that I want it, as you have to sign up for an account just to enter the shop.

I suspect it will be cheaper to buy a conversion tool and just batch convert them to .msg if they end up needing them.

I did try the print to .pdf with a couple of different tools I have and one was better than the other, giving a very visibly acceptable result - might not pass muster as a court document if it comes to that, but at least I can do that for free if needed in the short term.

Thanks very much for the assorted help.