The disputed email: authenticating Gmail and Outlook 365 messages in a contract claim.
A composite scenario reflecting a routine email-authentication instruction, details altered, the method real. A supplier sues a construction firm for six figures over a variation it says was agreed by email. The supplier produces a message approving the additional works; the firm produces its own copy of the "same" email, with the approval paragraph absent. One of the two documents is not what it claims to be. The supplier runs Google Workspace; the firm runs Microsoft 365. Both parties' solicitors agree to a single joint expert.
Method
- 01Go past the printout. Both sides had disclosed PDFs. We required the native messages: a Google Vault export of the supplier's sent mail, and a Purview export of the firm's mailbox, each hash-verified on receipt and covering the full thread, not the single message.
- 02Read the headers. Every email carries a routing history: received chains, message IDs, and a DKIM signature applied by the sending platform that cryptographically covers the message body. The supplier's version validated against Google's DKIM signature. The firm's version failed validation, its body no longer matched what Google had signed at the moment of sending.
- 03Check the stores. Purview's recoverable-items store still held an earlier copy of the firm's message, identical to the supplier's version, approval paragraph included. Mailbox audit records showed the item had been exported, deleted and re-imported from a PST file two days after the letter of claim arrived.
- 04Report to both parties. As joint expert, we set out the validation results, the recovered original and the audit trail in a single CPR 35 report, with the technical workings annexed so either side's advisers could have them independently checked.
Outcome
The claim settled within a month of the report being served. The altered exhibit was withdrawn, and the question the court would have spent days on, which email is real, was answered by cryptography and retention stores in a dozen pages.
Lesson
Never litigate on a printed email. The native message, with headers, signatures and its position in the mail store, can usually prove or disprove authenticity outright, and both Google Workspace and Microsoft 365 keep more history than the parties themselves realise. Ask for native production early, and preserve mailboxes before anyone has a reason to tidy them.