Evidence certification · Email
Certify an email as evidence: authenticity, origin and spoofing
We analyse the full headers, SPF, DKIM and DMARC authentication and the sender's trail to establish whether an email is authentic or has been tampered with or spoofed, and we certify it in a signed expert report.
- Gmail, Outlook, Exchange
- CEO fraud
- Expert no. 02714
Updated on 26 September 2026
What we analyse
What an email reveals in its original format
A forwarded or printed email loses the headers that prove where it came from. We work on the original message (.eml file or access to the mailbox).
Server route, IP addresses and timestamps.
SPF, DKIM and DMARC results for the sending domain.
Hash and metadata of each file.
Signs that the body or the date have been edited.
The domain and server it was actually sent from.
SHA-256 hash of the message in its original format.
Common cases
When it is needed
- CEO fraud and changed bank details on invoices
- Impersonation of a supplier, a customer or an executive
- Claims against suppliers and customers based on emails
- Dismissals and employment communications
- Counter-expert report on emails submitted by the other side
How it works
From the first message to the signed report
-
01
Triage
You describe the email and what you need it for; we tell you how to preserve it without forwarding it.
-
02
Obtaining the original
.eml export or one-off access to the mailbox, with a signed record and SHA-256 hash.
-
03
Analysis
Headers, authentication, origin tracing and signs of tampering.
-
04
Report
Signed report, with availability to confirm it in court.
What you receive
A report your lawyer can file without changes
- Expert report signed by court expert no. 02714
- Header analysis and sender authentication
- Annex with the original message and its SHA-256 hash
- Testimony at the hearing, if we are summoned
Frequently asked questions
Before you instruct us
Is a forwarded email any use?
No: forwarding strips the original headers. We need the message in its original format, exported from the mailbox or through one-off access to the account.
Can you find out who sent a fake email?
We can establish which server and domain it was really sent from and whether it impersonated another sender. Identifying the actual person depends on what that data reveals and, often, on a court order.
Does it help with CEO fraud or a changed IBAN?
Yes. The report shows that the email did not come from the legitimate domain and documents how the impersonation was carried out, which is useful with the bank, the insurer or the court.
Do you need access to my whole mailbox?
No. The specific message or thread in its original format is enough; if mailbox access is needed, it is limited to what is necessary and documented in the record.
We serve Elche, Alicante, Murcia, Valencia and the whole of Spain.
Carrer Santiago Ramon y Cajal, 41 · Modulo 1, planta 1, local 13
03203 Elche · +34 965 56 38 00
WhatsApp, email, phones, drives, social media and websites: extraction, hash and signed expert report.
View page Signed by IT expert witnessAccreditation no. 02714, methodology and courtroom experience.
View page
