Services / Governance, Data Protection & Compliance

Email forensics for law enforcement authorities

In proceedings involving fraud, extortion, identity misuse or data exfiltration, an email is often the central piece of evidence. Whether it is authentic, where it was submitted and which path it took can be established from headers, signatures and server logs. We support public prosecutors, police and other authorities with technical analyses and written reports that non-technical readers can follow.

Email Forensics
Header Analysis
DKIM Verification
Exchange & Microsoft 365
Criminal Proceedings
Expert Reports

Get in touch →

Services

Origin analysis Evaluate the Received chain, submitting IP addresses, mail servers and timestamps; clearly separate reliable header fields from forgeable ones.

Authenticity verification Verify DKIM signatures after the fact, put SPF and DMARC results into context, detect manipulation of content or headers.

Log and platform analysis Exchange message tracking, Message Trace and audit logs from Microsoft 365, gateway logs: reconstruct delivery, forwarding and access.

Compromised accounts Determine whether and since when a mailbox was taken over and which messages the attacker sent, read or deleted.

Report and explanation Written report with method, findings and limits of the conclusions; explanation to investigators and the court.

Method and evidential value

Analysis is performed on copies of the secured data, never on the originals; hash values prove that the copies are unchanged. Header analysis uses tools that work locally, so evidence does not leave the controlled environment. Every step is documented so that another expert can repeat it. The report separates findings, interpretation and open questions; anything the data cannot substantiate is stated as such. Engagements are possible as an expert under Art. 182 ff. of the Swiss Criminal Procedure Code (CrimPC) as well as technical support for ongoing investigations.

How an engagement runs

1 Mandate and questions The authority formulates the questions; scope, deadlines and the form of data handover are defined.
2 Data handover Copies with hash values, documented handover and secure storage.
3 Analysis Evaluate headers, signatures and logs, substantiate findings with the raw data.
4 Report Answers to the questions asked, method and limits of the conclusions, oral explanation if required.

24 Sep 2026 · SMTP & Mail Flow MailHeaderAnalyzer: Analyze Email Headers in PowerShell Without Network Access Reference for the MailHeaderAnalyzer PowerShell module: parameter overview, syntax, description, examples, and parameter properties for Get-MailHeaderAnalysis and ConvertTo-MailHeaderReport, plus the output object with delivery chain, authentication results, Exchange Online classification, and all finding codes. 26 Aug 2026 · Microsoft 365 / Exchange compauth in Microsoft 365: Composite Authentication and All Reason Codes Microsoft 365 supplements SPF, DKIM, and DMARC with its own evaluation: compauth. What Composite Authentication checks, what pass, softpass, fail, and none mean, and what causes each reason code, from 000 to 905. 26 Aug 2026 · Exchange OnPrem / Hybrid AuthMechanism 10 and AuthAs Internal: How Exchange Classifies Message Submission in the Header The X-MS-Exchange-Organization-AuthMechanism header documents how a submitting server authenticated. Value 10 indicates a Receive Connector with Externally Secured and classifies external emails as internal, with consequences for spam filters, mail flow rules, and spoofing protection.

Check it yourself

Mail header analyzer ↗ Delivery path, authentication and classification from the header, entirely local in the browser.

Planning something similar?

In a first conversation, we'll look at where you stand, the risks and the most sensible next step.