Comments on: Falsification of an email sent from Lotus Notes

By: thejumper

thejumper — Wed, 05 Dec 2012 05:14:00 +0000

Thank you both.

By: TomLiotta

TomLiotta — Tue, 04 Dec 2012 09:58:06 +0000

So far, I can’t see any direct evidence of falsification.

The biggest missing pieces are the “headers”. That is, there are no useful headers included. The pieces that you are calling ‘headers’ are not actual e-mail headers. It’s possible that you don’t have access to them.

Can you open the forwarded items? Or can you only read them as text attached to the outer e-mail? IMO, the only valid “forwarding” will send a copy of the actual e-mail item. That will include the original SMTP headers and those would be needed to help with falsification tests.

The format of anything within the body of an e-mail can’t be relied upon. For the body, all you can do is ask the sender to explain any detail that seems unusual. A date formet for example can look different for many reasons.

Tom

By: Gabe9527

Gabe9527 — Mon, 03 Dec 2012 17:02:19 +0000

I am unsure on what you want out of this thread. There is no way that anyone here can give you what you seem to want. We are not going to say if the email is real or not incase you use this information to do something that you should not.If the email is importent then should should request the email extracted from a Complaince Journal Search – this will show you the email as it was initially sent / received. If you are not Journalling emails then I think you are out of luck unless you can get a copy of the semt IT (and having it sent to you is not going to be admissible).So the true answer to this is – sorry but without a Journaled email to compare with then you just have to accept that this email may not be right.

By: thejumper

thejumper — Sat, 01 Dec 2012 01:09:30 +0000

Could someone tell me what they think? Thanks.

By: thejumper

thejumper — Wed, 28 Nov 2012 03:02:49 +0000

It was asked from the person1 to forward the emails to me in their original forms: the email, the answer1, and the answer2. Each time there was an aswer, all the preceeding emails were showed in the answer. If you need more information, please let me know. Thanks.

By: thejumper

thejumper — Tue, 27 Nov 2012 18:32:34 +0000

Email#3: From: Name of Person1….. To: Name of Person2 … Date: 2012-03-10 10:25 AM …. Subject: Re: Lorem ipsum dolor Lorem ipsum dolor sit amet, consectetur adipiscing elit.

Email#2: From: Name of Person2….. To: Name of Person1 … Date: 2012-03-09 12:14 AM …. Subject: Re: Lorem ipsum dolor Fusce aliquam ligula in elit blandit porta. Vestibulum facilisis, elit ut aliquam euismod, erat elit tempor mi, et pulvinar velit neque.

Email#1: 2012/3/4 Name of Person1 Nullam fringilla viverra erat sed laoreet. Aenean elementum enim ac elit ultricies

By: thejumper

thejumper — Tue, 27 Nov 2012 18:25:19 +0000

Thanks TomLiotta. The person A sent the email #1 to the person B asking them for a document, the person B answered with an email #2 , and attached a document to the email #2. The person A answered again with an email#3 and attached another document.So in the end you can see the 3 emails, the email#1, and the answer email #2, and the answer email #3.When I asked for this correspondence, the person A forwarded to me the three emails in one document, because each email is the answer to the one preceding it. it was like this (I’m including only the headers)

Email#3: From: Person1….. To: Person2 … Date: 2012-03-10 10:25 AM …. Subject: Re: Lorem ipsum dolor

Email#2: From: Person2….. To: Person1 … Date: 2012-03-09 12:14 AM …. Subject: Re: Lorem ipsum dolor

Email#1 2012/3/4 Name familyname@xyz.ab.cd

When I looked at the email#1, there was no from, no to, no subject, no date, so I knew something was not right, then I looked at the way the date was written, and it doesn’t respect the way it’s written in Lotus, if you look at the email#2 the date is: 2012-03-09 12:14 AM. If you look at the email#3, the date is: 2012-03-10 10:25 AM. But for the email 1, the date is: 2012/3/4, a format that doesn’t respect the lotus notes format.the fact is if the email has been falsified, that means that it could be possible that the titles of the documents attached has been modified too. In this case I don’t even know if the documents attached I received are the originals. And I need the original documents attached.Thanks for helping me.

By: TomLiotta

TomLiotta — Tue, 27 Nov 2012 01:30:58 +0000

The email was forwarded to me.

So, we have at least three e-mail events to consider.

The person sent me the email he sent, and the answer he received.

The first e-mail event that is involved is referred to as “The person sent me…”. It is the full e-mail that was sent to you. I’ll call that e-mail #1. This is the e-mail item that you received. It contained the parts that you copied into your question. There is no information in your question about this e-mail except for the included parts of the other e-mails.

The second e-mail is referred to as “…the answer he received”. I’ll call that one #2. This would be the item that was forwarded to you inside of #1.

The third e-mail is referred to as “…the email he sent…”. I’ll call that one #3. This is what started things off. This is the item that you are concerned about.

Also, there are two other people involved. The first I’ll call PersonA, and the other will be PersonB.

PersonA sent #1 to you and sent #3 to PersonB. PersonB only sent #2 as a reply to PersonA. The reply was for #3.

So, it starts with PersonA sending #3 to PersonB. PersonB replies with #2 back to PersonA. Finally, PersonA forwards #2 to you inside of #1.

You are concerned that PersonA has somehow falsified parts of #3.

We can assume that PersonB didn’t falsify any of it because PersonA knows what was originally sent (since he sent the original).

Do you have an actual copy of #3 or is it only a part of #2? That is, did PersonA send you two separate items or just one?

It might be confusing, but that’s how I understand things. If any part seems wrong, please try to correct me. (And if anybody else thinks parts need to be clarified, please add comments.)

Tom

By: thejumper

thejumper — Mon, 26 Nov 2012 15:17:39 +0000

Thanks for taking the time to answer me. The email was forwarded to me. As the information inside the email is important, it was asked that the email should be forwarded as it is. When the date begin with the year, Lotus notes uses for its date this format year-Month-Day, and when the date is inferior to 10, the number is always written like this: 01, 02, 03, 04, etc.. and not like this 1,2,3,4, etc…This means that the email that was forwarded to me was not the original, as the date doesn’t respect the standard, and there is no subject for the email, no from:, no to: ,etc…The second part of the email dispaly all the information (date written respecting the standard, information on the sender (from:), the recipient (to:), the date the email was sent and the subject. But the original email has no information about it, only this (2012/3/4 Name familyname@xyz.ab.cd), which is note the standard used by Lotus notes.Thanks for telling what you think about what I said.

By: TomLiotta

TomLiotta — Mon, 26 Nov 2012 09:26:09 +0000

How do you know how any of it “should be written”? And how do you know what the sender’s client would include in an attached e-mail? Was the included e-mail ‘Attached’ or ‘Forwarded’? Do you know what the settings are for that person’s e-mail client? — Tom