I am working a case whereby a lot of the evidence is based on an iPhone screenshot of an email as the original email cannot be retrieved, due to “IT obstacles” (what a coincidence). Therefore based on the information I have, I am trying to workout which email client was used in the alleged exchange.
The original email is a forwarded email to him/herself and the layout is similar to this:
Fwd: Subject XYZ
Custom signature to say sent from phone (not normal sent from iPhone)
Begin forwarded message:
From: John Smith <John(at)xyz(dot)com> Date: 9. March 2018 at 07:42:23 GMT+1 To: XYZ example <info(at)example(dot)com> Subject: RE: Example Subject
This is an example of the email body.
-----Original Message-----
From: XYZ example <info(at)example(dot)com>
Sent: 8. March 2018 at 3:32 PM
To: John Smith <John(at)xyz(dot)com>
Subject: Example Subject
Dear John
Example body of text.
Custom signature to say sent from phone (not normal sent from iPhone)
The above is pretty much all I have to go on (the @ and . symbol was replaced with “at” and (dot) due to the forum rules in reality its really the correct symbol).
Now being that it is a forwarded message, that is already a red flag for me as it would be quite easy to just edit the text underneath to reflect whatever the person wanted.
What I’d really like to know though is if anyone has ever come across a full stop in the date section of the email. As at 1st glance it looks like an Outlook plain-text message, however the date format does not align. Any advice as to what the email client might be would be really appreciated.
In my experience, formatting of the quote strings is influced by regional settings. Here is what I get when I set my regional settings to Denmark and use Outlook 16 (64-bit):
From: John Doe <jdoe@example.com>
To: John Doe <jdoe@example.com>
Subject: RE: Test Message
Thread-Topic: Test Message
Date: Sat, 3 Oct 2020 09:44:02 -0700
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Here is the response.
-----Original Message-----
From: John Doe <jdoe@example.com>
Sent: 3. oktober 2020 09:44
To: John Doe <jdoe@example.com>
Subject: Test Message
Here is a test.
Note the quoted timestamp: 3. oktober 2020 09:44
It is also possible to customize the language and the date formatting within the regional setting of your choice. So, I could choose to have English language with Danish-style date formatting with the period if I wanted to.
In your example, it looks like the email client that performed the “reply” and the “forward” operations are not the same. I also see a reference to GMT+1.
I would research what regional settings apply and if the GMT+1 offset is consistent with that region on March 8 and 9th 2018 while taking Daylight Savings into account. For instance, in the UK, Daylight Savings started on March 25 in 2018.
You can then experiment to see if you can reproduce the quote strings yourself.
Thanks for the response and advice Arman. I have done some testing and have managed to reproduce the quote strings by first sending a message from an iPhone to a Windows Outlook Client. When I reply to the message (via outlook) to the iPhone it produces the quote string order:
-----Original Message-----
From
Sent
To
Subject
When the received message is then forwarded from my iPhone it produces the quote string order:
From
Date GMT + 1
To
Subject
Interestingly, I tested forwarding emails that I had received from colleagues in the US and Australia and every email I forwarded would then produce the GMT + 1 from my iPhone. I will do some testing on the regional settings as advised and see if I can get it to match.