A few days later, the supplier reports that the money never arrived.

The investigation now depends on several questions. Was the attachment altered? Did the message originate from the supplier’s account? Was an earlier invoice replaced with a modified version? What evidence can establish the sequence of events?

Answering these questions requires more than opening the PDF and examining its contents.

Email attachment forensics involves collecting, preserving and analysing files transmitted through email while maintaining their relationship to the original messages. Investigators examine file contents, metadata, email headers, timestamps, cryptographic hashes and related system records to understand what happened.

The work can support investigations involving phishing, business email compromise, financial fraud, unauthorised information disclosure and employee misconduct.

The difficulty is that digital evidence is easy to change, sometimes without anyone noticing. Downloading a file can introduce new filesystem timestamps. Opening a document in an application may create temporary files or modify properties. Exporting an email through different tools may also change its representation.

A sound investigation therefore begins with preservation, not inspection.

This guide explains how to examine email attachments, interpret the evidence and document findings without drawing conclusions that the available records cannot support.

What Is Email Attachment Forensics?

Email attachment forensics is the examination of files associated with email messages for investigative purposes.

An attachment may be a PDF, spreadsheet, image, compressed archive, executable program or another file type. Its contents can provide useful evidence, but the surrounding email often matters just as much.

Consider a spreadsheet containing confidential customer information.

Examining the spreadsheet may establish what information it contains. Examining the associated email may reveal the intended recipient, transmission date and accompanying message.

Mail server records, endpoint logs and other evidence may help determine whether the message was transmitted, delivered, accessed or acted upon.

These are separate findings.

An email containing a confidential attachment does not automatically establish that the recipient downloaded or opened it. Nor does a message appearing in a Sent folder, by itself, prove that the intended recipient received it.

The purpose of forensic examination is to establish what the evidence supports and identify what remains uncertain.

Email attachments as digital evidence

Attachments may contain information at several levels.

• Visible content includes the text, images, figures and other material a user ordinarily sees.
• Embedded content may include macros, scripts, links, objects, comments, hidden worksheets or additional files.
• Metadata may record document properties, software information, timestamps and other technical details.
• Structural information can reveal whether a file conforms to its expected format or contains unusual components.
• Contextual evidence comes from the original message, associated conversations, server records and relevant activity on the sender’s or recipient’s device.

Investigators should consider these layers together rather than treating any one property as conclusive.

When Email Attachment Analysis Is Necessary

Email attachments appear in many kinds of investigations, but the questions differ depending on the incident.

Business email compromise and invoice fraud

Business email compromise often involves deception around payments, financial instructions or business relationships.

A suspicious attachment may contain changed bank details, altered payment terms or a document designed to resemble an established supplier’s paperwork.

Investigators may compare the attachment with earlier verified versions, examine message routing and review related account activity.

The investigation should also consider whether an account was compromised or whether the attacker impersonated a legitimate sender.

Phishing and malware incidents

Some malicious emails contain documents, archives or other files intended to persuade recipients to execute harmful content.

Investigators may need to identify the file type, inspect embedded components and determine whether the attachment was opened or executed.

The attachment itself provides only part of the answer. Endpoint telemetry and security logs may be needed to establish subsequent activity.

Unauthorised information disclosure

An email attachment may contain customer records, intellectual property, internal reports or other restricted information.

The investigation may need to determine what data was transmitted, to whom and under what circumstances.

Access authorisation, retention requirements and privacy obligations must be considered before examining personal or confidential material.

Internal investigations and litigation

Contracts, correspondence, spreadsheets and other attachments can be relevant to employment disputes, internal investigations or legal proceedings.

In these cases, preserving the original evidence and documenting its handling may be particularly important.

The applicable legal requirements depend on the jurisdiction and circumstances. Investigators should work within their authority and obtain legal guidance where necessary.

Common Email Attachment Formats and Their Evidence

Different file formats contain different kinds of information.

A filename is not reliable evidence of the underlying file format.

A file called invoice.pdf may not be a valid PDF. A name such as invoice.pdf.exe may disguise an executable, especially when an operating system hides known extensions.

Investigators should identify the actual format using appropriate tools and, where necessary, inspect the file’s internal structure.

Even a matching file signature is not a guarantee that the file is harmless.

Establish the Investigation Scope Before Collecting Evidence

Before handling attachments, determine what the investigation is intended to establish.

For the suspicious invoice example, the initial questions might be:

• What attachment was delivered to the finance employee?
• What did the original email contain?
• Was the attachment identical to an earlier supplier invoice?
• What evidence supports or contradicts the apparent sender’s identity?
• Did the employee open the document?
• Did the attachment contain malicious code or simply altered payment instructions?

These questions guide collection.

They also help prevent investigators from gathering unrelated personal or business information without justification.

Confirm authority and retention requirements

Investigators should establish that they are authorised to access the relevant mailboxes, devices and records.

Legal holds, contractual obligations, privacy rules and organisational retention policies may affect how evidence is collected and stored.

Cloud-hosted mailboxes may require administrative exports or service-provider records.

The method used should be documented because different export processes may preserve different properties.

Identify all relevant evidence sources

The attachment may be present in several locations.

Possible sources include the original mailbox, a downloaded copy, a local email archive, an endpoint, a backup or a security system.

Each copy may have different contextual information.

A downloaded PDF, for example, may no longer contain a direct record of the email message from which it originated.

Collecting the original message alongside the attachment helps preserve that relationship.

Preserve the Original Email and Attachments

Preservation is the first technical priority.

When possible, retain the original message in a suitable format that preserves its headers, MIME structure, body and attachments.

EML, MSG and mailbox-container formats can be useful, but their preservation characteristics depend on the source system and export method.

For example, an MSG file exported from an email client is not necessarily a byte-for-byte representation of the message as transmitted over the network.

Investigators should document the source and export process rather than assuming that every saved email file is equivalent.

Work from forensic copies

Original evidence should be protected against unnecessary modification.

Create a controlled working copy for examination and maintain the source evidence separately.

Where appropriate, use read-only access, restricted storage permissions and verified acquisition methods.

If the evidence comes from a live cloud mailbox, the collection process may differ from acquiring files from a local storage device.

Record acquisition details

At minimum, document the evidence identifier, source, collection date and time, collector, acquisition method and storage destination.

Record relevant software and versions, export settings and any collection limitations.

Use consistent time zones, preferably retaining original timestamp information and documenting any conversion to UTC.

If an acquisition fails or produces an incomplete result, record the problem rather than silently repeating the process.

Maintain a Defensible Chain of Custody

A chain of custody records how evidence has been handled from collection through examination, storage and transfer.

It helps answer who had access to the evidence, when they received it and what happened while it was under their control.

A basic record may contain the following information.

The example is illustrative and does not represent an actual investigation.

A chain-of-custody record should be maintained as events occur, not reconstructed from memory weeks later.

Access controls and audit logs can provide additional support, but they do not replace accurate documentation.

The Scientific Working Group on Digital Evidence provides guidance on evidence collection, integrity and documentation. Its publications should be applied alongside organisational procedures and applicable legal requirements.

Identify the Attachment’s Actual File Type

Once evidence is preserved, examination can begin on a working copy.

Start with the filename, extension, file size and actual file structure.

Many file formats contain identifiable byte patterns, commonly called file signatures or magic numbers.

These can help determine whether a file resembles the format indicated by its extension.

However, file signatures are not a complete validation method.

Some formats share structural characteristics, and malicious content can be embedded in otherwise valid files.

Check for misleading extensions

Attackers may use filenames intended to appear harmless.

An attachment may contain multiple extensions, unusual Unicode characters or a name that is misleading when displayed in an email client.

Record the exact filename and examine it without executing the file.

Examine archives carefully

Compressed attachments may contain nested directories, encrypted files or unexpected executables.

Archive extraction should occur in a controlled environment.

Investigators should also consider resource-exhaustion risks, such as archives that expand to unusually large sizes.

Avoid extracting untrusted archives directly into sensitive working directories.

Examine Attachment Metadata

Metadata can provide useful leads, but it is frequently misunderstood.

A Word document may contain an author field. A PDF may record software used to generate it. An image may contain camera or editing information.

These details can help establish relationships between documents or identify inconsistencies.

They do not automatically establish who created a file or when it was first produced.

Common metadata fields

Metadata should be compared with other evidence.

Suppose a document’s author property contains an unfamiliar name.

That may justify further examination. It does not prove that the named person created the document, nor that the document is fraudulent.

Templates, shared computers and document conversion processes can all influence metadata.

Calculate and Verify Cryptographic Hashes

Cryptographic hashes help investigators compare files and monitor integrity.

A hash function produces a fixed-length value from the bytes of a file.

SHA-256 is commonly suitable for recording file integrity in contemporary workflows.

If two files have matching SHA-256 hashes, that provides strong evidence that their byte contents are identical.

If their hashes differ, the files are not byte-for-byte identical.

Neither result, on its own, establishes whether the contents are truthful or malicious.

Example: calculating a SHA-256 hash on Windows

For an authorised working copy, PowerShell can calculate a hash without opening the document in its associated application.

Get-FileHash -LiteralPath "C:\Evidence\invoice.pdf" -Algorithm SHA256

Record the resulting value, the filename, evidence identifier, algorithm and relevant examination details.

Example: calculating a SHA-256 hash on macOS or Linux

shasum -a 256 /path/to/evidence/invoice.pdf

The file path should refer to the appropriate evidence or working copy.

These commands are useful for straightforward file hashing. They do not replace a complete forensic acquisition procedure.

Integrity is not authenticity

Consider two invoices with identical filenames.

Their hashes differ because the bank account numbers are different.

This establishes that the files are not identical.

It does not establish which invoice is legitimate.

To investigate authenticity, compare the documents with trusted supplier records, original correspondence, relevant business systems and other corroborating evidence.

A hash is an integrity tool, not a fraud detector.

Examine Email Headers and Message Authentication

The original email may contain information that is absent from a separately downloaded attachment.

Investigators should preserve and examine the message headers and MIME structure.

Internet email uses standardised message fields, including From, To, Date, Subject and Message-ID.

The meaning and reliability of each field must be considered carefully.

Visible sender versus actual message origin

The From address displayed by an email client may not reliably identify the person or system responsible for sending a message.

An attacker can impersonate a familiar display name or use a misleading address.

Investigators may examine routing information, authentication results and server records to assess the message’s origin.

Received headers

Received headers can record stages in a message’s transmission through mail infrastructure.

Their order, contents and reliability require interpretation.

Not every header should be treated as equally trustworthy. Some information may have been supplied by systems outside the investigator’s control.

SPF, DKIM and DMARC

Email authentication technologies can help evaluate aspects of message legitimacy.

• SPF allows receiving systems to check whether a sending server is authorised for a relevant domain.
• DKIM uses cryptographic signatures to verify selected message content and header information associated with a signing domain.
• DMARC defines domain-alignment and policy mechanisms using SPF and/or DKIM results.

These mechanisms are useful but limited.

A message that passes authentication is not necessarily harmless.

For example, an attacker operating through a compromised legitimate account may send a malicious message that passes normal domain authentication checks.

Likewise, an authentication failure does not automatically establish malicious intent.

Investigators should interpret these results alongside other evidence.

Message-ID and timestamps

Message-ID values can help correlate copies of messages, although they are not guaranteed to be unique or trustworthy in every circumstance.

Timestamps may reflect different stages of message creation, transmission, delivery or storage.

Time-zone differences and clock inaccuracies should be considered when constructing an incident timeline.

Inspect Attachment Content Without Compromising the Examination Environment

An unknown attachment should not be opened casually on an investigator’s everyday workstation.

Documents, archives and even some file previews can expose vulnerabilities in software used to process them.

The examination method should reflect the risk presented by the file.

PDF documents

Inspect visible content, embedded links, document properties and embedded objects where relevant.

A PDF that appears to contain only an invoice may include additional structures that warrant examination.

Word documents

Review visible text, comments, tracked changes and document properties.

Where applicable, inspect macro-enabled content and embedded objects without enabling active code.

Spreadsheets

Examine formulas, hidden worksheets, external links and unusual cell values.

In financial investigations, compare payment details and calculations against trusted records.

Images

Inspect visible content, dimensions and available metadata.

Image metadata may be missing or altered after editing, conversion or transmission.

Compressed archives

Review filenames, directory structure, encryption and contained file types.

Do not assume that an archive is safe simply because its outer extension is familiar.

Use isolated analysis environments

Potentially malicious attachments should be examined using approved tools and appropriately isolated environments.

Depending on the investigation, this may involve static analysis, controlled detonation or specialist malware-analysis facilities.

An isolated environment reduces risk but does not eliminate it.

Analysis systems must be maintained, monitored and configured to prevent unnecessary exposure to production networks or sensitive information.

Investigate Malicious Content and User Activity

A suspicious attachment may contain executable code, malicious macros, scripts, exploit content or deceptive links.

Its presence alone does not establish that an attack succeeded.

Investigators should distinguish among several events:

• Delivery: The message reached a mailbox or relevant email infrastructure.
• Access: The recipient or another process accessed the message or attachment.
• Execution: Code associated with the attachment ran on a system.
• Impact: The activity produced a security consequence, such as unauthorised access, data disclosure or system modification.

Each stage may require different evidence.

Correlate endpoint and email records

Relevant evidence may include email gateway logs, endpoint detection alerts, process execution records, application activity and network connections.

For example, an attachment containing a suspicious macro does not prove the macro executed.

Execution may require corroboration from endpoint telemetry or other records.

Interpret antivirus findings carefully

A positive detection is an investigative lead that should be evaluated.

A negative result does not guarantee safety.

Detection capabilities vary, and some malicious files may not be recognised by a particular product.

Protect sensitive evidence

Do not upload confidential attachments to public malware-analysis services without proper authorisation.

Such services may retain submitted files or make information available beyond the original organisation.

Where sensitive material is involved, use approved private analysis arrangements and follow the applicable data-handling policy.

Practical Case Study: Investigating a Suspicious Supplier Invoice

Consider a hypothetical manufacturing company that receives an invoice from a long-standing supplier.

The invoice references a legitimate purchase order, but its bank account details differ from those used previously.

The finance department identifies the discrepancy after the payment has been initiated.

The organisation opens an investigation.

Preserve the message

The investigator obtains an authorised export of the suspicious email, including its headers and attachment.

The collection method, source mailbox, timestamp and evidence identifier are recorded.

A working copy is created.

Examine the attachment

The investigator confirms that the attachment is structurally consistent with a PDF.

Its filename, size and SHA-256 hash are recorded.

Document properties are examined, but no conclusions are drawn solely from the author field or creation timestamp.

Compare trusted records

The suspicious invoice is compared with an earlier invoice obtained from a trusted business record.

The bank account numbers differ.

The investigator records the discrepancy and calculates hashes for both files.

Different hashes confirm that the files are not byte-for-byte identical, but do not explain why.

Examine the email context

The investigator reviews the original message headers, authentication results and related correspondence.

The apparent sender’s address is compared with previously verified supplier contact information.

The investigation also checks whether the revised payment instructions were confirmed through an established communication channel.

Correlate supporting evidence

Relevant payment records, email logs and authorised endpoint records are examined.

The investigator considers alternative explanations, including legitimate changes, account compromise and sender impersonation.

Report the findings

The final report identifies the altered payment information, documents the available evidence and explains any limitations.

If the evidence does not establish who modified the invoice, the report should say so.

A forensic report is stronger when it distinguishes confirmed observations from unresolved questions.

Validate the Tools Used for Examination

Forensic tools can help process large collections of email and attachments.

They may support message searching, metadata review, attachment extraction, file-type identification or reporting.

However, no application should be assumed to produce complete or accurate results under every condition.

Match the tool to the task

An email viewer may be suitable for reading supported mailbox formats.

A file-analysis utility may be better for examining document structure.

A malware sandbox serves a different purpose from a mailbox search tool.

A forensic acquisition tool may be required to preserve a source system in a defensible manner.

Using one application for every stage can introduce unnecessary limitations.

Test relevant capabilities

Before relying on a tool in an investigation, establish whether it correctly handles the relevant file formats and evidence conditions.

Testing may include known sample files, messages with multiple attachments, encoded filenames, unusual MIME structures and corrupted data.

Record the tool name, version, settings and any relevant validation results.

Preserve traceability

An extracted attachment should remain traceable to its source message.

Record the relationship between the message identifier, attachment filename, acquisition record and extracted file.

If an export process changes the representation of a file, document that behaviour.

Do not assume that every preview or conversion preserves the original bytes.

Prepare a Clear Forensic Investigation Report

A useful report explains what was examined, how it was examined and what the results mean.

It should be understandable to the intended audience without concealing technical limitations.

Essential report contents

Separate observations from interpretations

A report might state:

The attachment contains a bank account number different from the account recorded in the supplier’s earlier verified invoice.

That is an observable comparison.

It should not automatically state:

The employee deliberately changed the invoice.

The second statement assigns responsibility and intent that may require additional evidence.

Investigators should explain the basis for each significant conclusion and identify plausible limitations.

Retain examination records

Preserve relevant notes, logs, hashes, tool information and report versions according to the organisation’s evidence-retention requirements.

The final report should allow another qualified examiner to understand the methods used and, where possible, reproduce material findings.

Common Mistakes in Email Attachment Investigations

Several mistakes can weaken an otherwise sound examination.

1. Collecting only the attachment. This may remove important message context.
2. Opening suspicious files on ordinary workstations. This can expose the investigator’s environment to malicious content.
3. Failing to record acquisition details. Without adequate documentation, it may be difficult to explain where the evidence came from.
4. Treating metadata as proof of authorship. Document properties can be inaccurate or manipulated.
5. Confusing matching hashes with authenticity. Byte-level consistency does not establish that a document is genuine.
6. Assuming an attachment was opened because it was delivered. Delivery and execution are different events.
7. Relying on one forensic application. Different tools may have different parsing and export limitations.
8. Ignoring time-zone differences. Incorrect timestamp interpretation can distort the investigation timeline.
9. Uploading confidential evidence to unapproved services. This may create additional privacy or security exposure.
10. Writing conclusions that exceed the evidence. Uncertainty should be documented rather than hidden.

Email Attachment Forensics Checklist

Before closing an investigation, confirm that the following tasks have been addressed where relevant:

 Investigation scope and authority established

 Original message and attachment preserved

 Acquisition source and method documented

 Chain-of-custody record maintained

 Working copies separated from original evidence

 File types and structures examined

 Relevant metadata recorded and interpreted

 Cryptographic hashes calculated and documented

 Email headers and authentication results reviewed

 Suspicious content examined using approved safeguards

 Related endpoint, mail and business records considered

 Significant findings independently corroborated where possible

 Tool limitations and uncertainties documented

 Report reviewed for factual accuracy and traceability

Not every case requires every technique.

The appropriate depth depends on the investigative question, available evidence, legal authority and risk.

Frequently Asked Questions

What is email attachment forensics?

Email attachment forensics is the collection, preservation and examination of files associated with email messages. It can involve file content, metadata, cryptographic hashes, email headers and supporting system records.

Why should investigators preserve the original email?

The original message may contain routing information, timestamps, sender and recipient fields, MIME structure and contextual information that a separately downloaded attachment does not preserve.

Can attachment metadata prove who created a document?

Not by itself. Metadata can be edited, inherited from templates or affected by software and file operations. It should be evaluated alongside independent evidence.

What is the purpose of SHA-256 hashing?

SHA-256 hashing helps investigators compare file contents and verify that evidence has not changed between recorded checks. It does not establish whether a file is authentic or malicious.

Can an email pass SPF, DKIM or DMARC checks and still be fraudulent?

Yes. Authentication results can help assess aspects of message origin and integrity, but they do not guarantee that the sender’s account is uncompromised or that the message content is trustworthy.

How should suspicious attachments be examined?

Preserve the original evidence first. Use approved security tools and appropriately isolated environments for potentially malicious content. Avoid opening unknown attachments on ordinary production computers.

Can forensic tools determine whether a recipient opened an attachment?

An email examination tool may identify a message and its attachments, but establishing whether a recipient opened or executed a file may require endpoint logs, application records or other supporting evidence.

What should an attachment forensic report include?

A report should document the evidence source, acquisition method, integrity checks, examination procedures, technical findings, corroborating records, limitations and conclusions.

Is a chain of custody necessary for internal investigations?

Documented evidence handling is valuable in internal investigations and may be required by organisational policy or applicable legal processes. The appropriate procedure depends on the circumstances.

Conclusion

Email attachments can be central to investigations involving financial fraud, phishing, data disclosure and other security incidents.

Yet an attachment rarely tells the complete story on its own.

Its contents may explain what information was transmitted. Metadata may reveal useful technical details. Hashes can support integrity checks. Email headers and system logs may help reconstruct how a message moved through an organisation and what happened afterward.

The reliability of the investigation depends on how these findings are collected, interpreted and documented.

Preserve the original evidence, work from controlled copies, use appropriate examination tools and corroborate significant conclusions wherever possible.

Most importantly, distinguish what the evidence establishes from what remains uncertain.

That distinction is fundamental to credible digital forensic work.

References and Further Reading

Authoritative technical and forensic references

National Institute of Standards and Technology (NIST)

• NIST SP 800-86 — Guide to Integrating Forensic Techniques into Incident Response. Foundational guidance on forensic techniques used in incident response.
• NIST SP 800-61 Revision 3 — Incident Response Recommendations and Considerations for Cybersecurity Risk Management. Updated incident-response guidance published in April 2025.

Scientific Working Group on Digital Evidence (SWGDE)

• Best Practices for Digital Evidence Collection. Guidance on evidence handling, integrity and documentation.

Internet Engineering Task Force (IETF)

• RFC 5322 — Internet Message Format. Technical specification for internet message structure.
• RFC 2045 — Multipurpose Internet Mail Extensions (MIME), Part One. Foundational specification for MIME message bodies and content encoding.

MITRE

• MITRE ATT&CK — Phishing. Reference information about phishing techniques, including malicious attachments.

Commercial resource

MailPro+ — Email Forensic Examination Software – MailPro+ is a commercial email examination product referenced by the article contributor. Sponsored commercial reference. Inclusion does not constitute an independent product review, technical validation or endorsement by Witanworld.

Editorial note: This article provides general educational guidance. Digital forensic procedures must be adapted to the investigation, applicable law, organisational policy and available technical evidence. The hypothetical invoice-fraud example is illustrative and does not describe a documented case.

Comments (0 Comments)