determine whether a forwarded email has been faked

Hi, One of my clients has somebody claiming to have sent them an email 2 days ago which they never recieved, I have checked my  SBS 2008 exchange logs, there is no record at all of the message. The person has "forwarded a copy of the message they had originally sent but i feel this forward may have been faked to look as if they had sent it, I.e. adding the lines of text manually which state the original time/date the message was sent.

Is there any way to determine if this is the case?

Gas
GazClimbsAsked:
Who is Participating?
 
BusbarConnect With a Mentor Solutions ArchitectCommented:
Hi, how did he forwarded the message, if he sent the message and commented in it then it can be 100% faked, ask from him to send the original email as attachement not forwarding it, then you can inspect the message header and see from where the message came from
0
 
GazClimbsAuthor Commented:
It was forwarded in the normal way and commented, I cannot ask them to send the original as an attachment as this would be leveling an accusation, thanks for you answer

gaz
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.