Confronting Counterfeit Communications: Authentication of Email and Digital Documents

Digital Communication has become standard in modern society – whether for basic conversation, social media interactions, corporate workflow, or legal contracts. Unsurprisingly, by extension digital communications are at the center of most legal disputes that arise today. Emails, text messages, and electronic documents are primary sources of evidence and are the lifeblood of many lawsuits before the courts today.

The ease and accessibility of digital communications, however, do leave these documents susceptible to modification or tampering. And while attorneys are bound by rules of ethical conduct, even the most prudent counsel may not be privy to an artful counterfeit put forth by a client who feels it necessary to “win at all costs.” Capsicum has been involved in several cases that serve as prime examples of the consequences of putting forth fabricated e-mails in a legal dispute.

A recent matter involved a dispute over the purchase agreement of a company. The Plaintiffs brought a motion before the court alleging Defendants made false representations about the nature of the business and the assets which Plaintiff was to receive under the Purchase Agreement. At the hearing, the Court learned of a troubling situation involving a series of discrepancies between emails produced by Defendants and emails produced by Plaintiffs.

After becoming involved in the case, Capsicum focused on four allegedly fabricated or altered emails. It was undisputed that two of the emails produced by Plaintiffs and that two were produced by Defendants; the question raised by the motion is which of the emails is authentic. Our analysis involved taking a forensic image of the respective computers of the parties, indexing the respective email accounts on each computer, searching the email accounts for keywords, for emails sent on specific dates, and for emails from specific senders, among other searches. We also searched the entire drive of each computer for evidence that the emails ever existed.

Capsicum testified to its findings before the court. It was determined that the allegedly fabricated emails share a common attribute demonstrating that they could be inauthentic: the header of each email shows the text “mailto” preceding Plaintiff’s email address.  The presence of “mailto” indicates that the reply or forward button was used to presumably edit the email thread. Capsicum concluded that each of those emails was fabricated, altered, or never sent (at least not sent in the form presented to the court). In perhaps the most telling indicia of purposeful fabrication, Capsicum testified that the authentic email was located in three locations on Plaintiff’s computer, including a backup file, unallocated space on the hard drive, and in a PDF file that had been deleted. The presence of this email in each of the three locations in which it was found indicates that Plaintiff did have the authentic email and had deleted them.

Capsicum’s testimony overwhelmingly demonstrated that spoliation occurred in this case. Because the court found the emails go to the heart of the case, the only available remedy proportional to the deleterious conduct was outright dismissal of Plaintiffs’ claim. Ultimately, the court granted Defendants’ motion for sanctions based upon unequivocal evidence that Plaintiffs manipulated and fabricated emails material to the litigation. This serves as another timely reminder Courts do not take dishonesty lightly, and the truth about digital communications can always be discerned by a digital forensic expert.

About Capsicum:

Capsicum was founded in 2000 within the law firm of Pepper Hamilton, LLP. Charged with providing technology consulting support to their clients, we soon realized that the need to understand, collect, and forensically analyze digital data went far beyond what we were handling: We began our journey as general technologists, but quickly became specialists in digital forensics. Our areas of expertise soon evolved and expanded into forensic investigations, cybersecurity, discovery, electronic and paper recovery, security, regulatory compliance, and incident response retainers. In 2002, Capsicum became an independent consulting company that focuses on these core services. Employing high-caliber experts and a unique understanding of data, technology, and the law, we support organizations that need technological proficiency to run their companies and when they come face-to-face with difficult tech, legal, and regulatory situations. Capsicum is headquartered in Philadelphia, PA with offices in New York, Florida, Texas, and California.