Start with the right question
A forwarded email can be convenient but may omit information or alter how a thread is displayed. Build an email index that points to the original messages and explains what each one contributes. Do not assume a familiar display name proves who sent it.
Work through the checks
Preserve the message format
Use the mail service's supported export or download method for messages you may access. Record the format and capture date. Keep a readable copy for review without discarding the original exported item.
Track the addresses
Record the visible sender, reply-to address, recipients, and message identifier if available. Headers can require technical interpretation; copy them accurately rather than treating one field as conclusive evidence of identity.
Link the attachments
Record attachment names and whether they were actually included in the message being reviewed. A document saved elsewhere with a similar name may be a different version from the one the recipient received.
Preserve the thread context
Distinguish an original message from quoted text in a later reply. Note missing replies or truncated content. Keep subject changes and separate conversations visible instead of merging them into one narrative.
A record you can use
- Message reference and date
- Sender and reply-to fields
- Original export filename
- Attachment version
- Question about origin or delivery
Keep this record locally. Use document references rather than publishing account numbers or other people's personal details. An empty field means the information is still missing; it should not be filled with an AI guess.
Worked example
A fictional supplier dispute includes an email displaying the supplier's name but a different reply-to address. The recipient preserves the original message and confirms payment instructions through a known contact. The file records the mismatch without claiming that the header alone identifies the person responsible.
This example is fictional and illustrates the method, not a real case result.
Limits and next steps
Do not open suspicious attachments merely to complete the record. Headers can contain private routing and account information. Share them only with an appropriate recipient, and obtain specialist help for contested authenticity.
Prepare a short email index with the relevant event and source reference. If phishing or payment diversion is suspected, follow the provider's reporting process promptly alongside preservation.