Email forensic expert in Barcelona
I establish whether an email is genuine, where it really came from and whether anyone has altered it. Useful in CEO fraud, invoices with a changed bank account and emails submitted in court.
Member of AEPEJU (no. 1556). Barcelona and across Spain.
Indicative fee: from €75. See prices
What you see on screen is not the email
The sender shown by your email client can be faked in seconds. What really counts is in the full headers and in the server mailbox: which servers the message went through, with which cryptographic signatures and at what time.
What I analyse
- Full headers: Received, Message-ID, Date and the real route of the message.
- SPF, DKIM, DMARC and ARC authentication: whether the domain authorised that sending and whether the message arrived unmodified.
- Consistency between headers, time zones and servers.
- Attachments: hash, metadata and versions, for example the invoice with the changed bank account against the original.
- .eml or .msg exports and the mailbox on the mail server.
CEO fraud and invoices with a changed bank account
There are two very different scenarios. In spoofing, someone sends from a look-alike domain or forges the sender. In a compromised account, the email leaves the supplier's real mailbox because someone got into it.
Telling them apart changes who should be liable and what can be claimed. When possible, I analyse the messages at both ends of the communication.
How I work
I obtain the original message from the mailbox, never a forward, because forwarding destroys the headers. I keep it in .eml format with a SHA-256 hash and an RFC 3161 timestamp, and I record the DKIM public keys published in DNS at the time of the analysis.
The whole process follows UNE 71506 and ISO/IEC 27037, so the other side can verify it step by step. If needed, I also analyse the recipient's or supplier's mailbox to confirm which version of the message and its attachments was actually sent.
What you receive
- An expert report with clear conclusions: genuine, altered, spoofed or not determinable, and why.
- A technical appendix with the analysed headers and the hashes of each file.
- Testimony in court if needed, quoted from day one.
Frequently asked questions
Common questions about this kind of report.
Is a printed email or a screenshot any use?
It is the weakest format: it has no headers or signatures to check. If it is challenged, it is hard to defend. What holds up is the original message from the mailbox.
Shall I forward you the email so you can see it?
No. Forwarding loses the original headers. I explain how to export it as .eml, or I obtain it from the mailbox with your consent.
Can you find out who sent an anonymous email?
You can trace it to the service and sometimes to the sending IP address. The actual identity requires a court order to the provider, and my report helps to support it.
What if the email is years old?
As long as it exists in some mailbox or backup, it can be analysed. Some checks depend on the domain still publishing its keys, so it is best not to wait.
You may also be interested in
Related expert reports.
Tell me about your case
Free 30-minute consultation and a free quote within 24 working hours.