# \#email-forensics

**URL:** https://community.metaspike.com/tag/email-forensics/6.md

[Latest](https://community.metaspike.com/latest.md) · [Categories](https://community.metaspike.com/categories.md) · [Tags](https://community.metaspike.com/tags.md)

---

## [Conversation Index Analysis in Email Forensics — Part 2](https://community.metaspike.com/t/conversation-index-analysis-in-email-forensics-part-2/2721)

<div class="topic-metadata">

**Author:** [@agungor](https://community.metaspike.com/u/agungor)\
**Replies:** 0\
**Last updated:** [July 31, 2026, 12:57am UTC](https://community.metaspike.com/t/conversation-index-analysis-in-email-forensics-part-2/2721 "2026-07-31T00:57:51Z")

</div>

Published a new blog on our website to cover “modern” Conversation Indices and go over how we calculate child block timestamps that overflow. You can read it here: Part 2 was 13 years after Part 1. Let’s hope Part 3 w…

---

## [Proton Mail Email Alterations](https://community.metaspike.com/t/proton-mail-email-alterations/2499)

<div class="topic-metadata">

**Author:** [@agungor](https://community.metaspike.com/u/agungor)\
**Replies:** 0\
**Last updated:** [September 3, 2025, 7:21pm UTC](https://community.metaspike.com/t/proton-mail-email-alterations/2499 "2025-09-03T19:21:15Z")

</div>

I was playing with Proton Mail for some new FEI Insights, and discovered that it is altering MIME message contents very significantly upon receipt. If you are a Proton Mail user and have some insights, I would be interes…

---

## [X-Apple-MoveToFolder Header](https://community.metaspike.com/t/x-apple-movetofolder-header/2481)

<div class="topic-metadata">

**Author:** [@SMELB](https://community.metaspike.com/u/SMELB)\
**Replies:** 1\
**Last updated:** [August 13, 2025, 6:57pm UTC](https://community.metaspike.com/t/x-apple-movetofolder-header/2481 "2025-08-13T18:57:10Z")

</div>

Hi all, I have a PST of a mailbox (AAA@corp.com) exported from Google Vault. Within the PST I have several emails with the following tags in the header: X-Apple-MoveToFolder: INBOX X-Apple-Action: MOVE\_TO\_FOLDER/INBOX …

---

## [How to Prove That An Email Was Received](https://community.metaspike.com/t/how-to-prove-that-an-email-was-received/2429)

<div class="topic-metadata">

**Author:** [@agungor](https://community.metaspike.com/u/agungor)\
**Replies:** 1\
**Last updated:** [June 27, 2025, 12:28am UTC](https://community.metaspike.com/t/how-to-prove-that-an-email-was-received/2429 "2025-06-27T00:28:33Z")

</div>

Just published a new blog on our website on proving email receipt in forensic investigations. You can read it here: I would be interested to hear what other strategies you use in similar scenarios. :grin:

---

## [Dates in Hiding Part 2—Gmail MIME Boundary Timestamps](https://community.metaspike.com/t/dates-in-hiding-part-2-gmail-mime-boundary-timestamps/288)

<div class="topic-metadata">

**Author:** [@agungor](https://community.metaspike.com/u/agungor)\
**Replies:** 2\
**Last updated:** [March 30, 2020, 3:34pm UTC](https://community.metaspike.com/t/dates-in-hiding-part-2-gmail-mime-boundary-timestamps/288 "2020-03-30T15:34:45Z")

</div>

This post on Gmail MIME boundary timestamps is an update to my previous Dates in Hiding post to cover some recent developments. Special thanks to @stigarve.hopland for his contributions!

---

## [Investigating Message Read Status in Gmail & Google Workspace](https://community.metaspike.com/t/investigating-message-read-status-in-gmail-google-workspace/649)

<div class="topic-metadata">

**Author:** [@agungor](https://community.metaspike.com/u/agungor)\
**Replies:** 0\
**Last updated:** [April 2, 2021, 4:59pm UTC](https://community.metaspike.com/t/investigating-message-read-status-in-gmail-google-workspace/649 "2021-04-02T16:59:55Z")

</div>

Just published a quick post to lay out three investigative techniques we can use to determine historical message read status in Gmail and Google Workspace.