Progressive Evidence Escalation™
Make evidence coverage explicit across text, raw .eml, and trusted SMTP. Link stronger-stage follow-up investigations while retaining the original record; linkage is not independent same-message proof.
EMAIL FORENSIC INTELLIGENCE
Investigate suspicious email with evidence you can explain.
Start with email text, the original .eml, or an assigned trusted receiver. Review authentication, identity, links, and infrastructure, connect related investigations, and preserve the findings in a signed evidence record.
Evidence-led analysisExplainable findingsVerifiable integrity
THE EVIDENCE LAYERWORKFLOW CONCEPT
FOUR IMPLEMENTED CAPABILITIES
Built around evidence trust, not feature count.
Trust-Boundary GeoTrace™
Distinguish message-carried relay claims from directly observed SMTP facts, with source labels and approximate infrastructure context. Map lines do not establish a measured route or identify a person.
MailGraph Campaign Memory™
Find weighted domain, IP, and attachment-hash overlaps within your workspace, with reasons for each related investigation. Common-provider overlap requires analyst review; it is not campaign attribution.
Evidence Passport™
Bind the canonical evidence and manifest with SHA-256 and Ed25519. Reopen the original signed snapshot and check signature, hashes, key identity, and configured issuer trust.
PROGRESSIVE ACQUISITION
Stronger evidence, explicit claim boundaries.
A stronger acquisition stage improves forensic coverage; it does not automatically make a phishing verdict more correct.Pasted textSubject/body, content signals, and visible links. Original headers, attachments, and transport facts remain unavailable.
LIMITEDRaw .emlMessage-carried headers, authentication/alignment evidence, identity relationships, MIME structure, attachment metadata/hashes, and recorded relay claims.
STRONGERTrusted SMTP receiverOriginal email plus directly observed client IP, HELO, and envelope facts at an authorized, configured boundary.
TRUSTED BOUNDARYWHAT YOU CAN REVIEW
A decision with its supporting evidence.
See what the message supports.
Inspect available DKIM, ARC, and alignment checks, sender relationships, and recorded relay context. Trusted SPF requires an observed SMTP boundary.
Keep signals in context.
Review URL classification and attachment metadata, type patterns, and hashes. Link strings are not browsed destinations, and attachment contents are not executed.
Preserve a reviewable record.
Reopen scoped investigations, associate evidence with cases, and export supported JSON, CSV, observed-artifact, or STIX records. Preserve the complete signed package for verification.
Understand the next action.
Review correlated risk, coverage gaps, and policy recommendations. Required failures remain explicit; unavailable evidence does not silently become a safe result.
FROM REVIEW TO RECORD
Acquire → Trace → Correlate → Verify
One evidence workflow, with source-aware review, related investigations, and an independently verifiable record.UNDERSTAND THE EVIDENCE
Email investigation questions.
What does VeriTrustLab analyze?
VeriTrustLab analyzes suspicious email text and raw EML files with AI-assisted signals and evidence checks. A configured trusted SMTP receiver adds directly observed transport facts. Start with email investigation or read the workflow documentation.
Can email infrastructure location identify the sender?
No. Infrastructure location is approximate and does not identify a person. Message-carried relay claims remain distinct from transport facts observed by a trusted SMTP receiver. The trusted receiver guide explains the acquisition boundary.
What does an Evidence Passport verify?
An Evidence Passport uses SHA-256 and Ed25519 to check package integrity, key identity, and configured issuer trust. Keep the complete original evidence and Passport together. A valid signature does not prove that an email is safe or that every recorded claim is true. Use the evidence verifier to inspect the package.
How should I interpret an AI risk score?
Use scores alongside available evidence and explicit gaps. Missing provider results are unavailable, and stronger acquisition does not guarantee a more accurate verdict. Review model evaluation disclosures and analysis limitations.
Does analysis cover every byte?
No. The pretrained email and URL classifiers use bounded inputs and text sampling. Attachment checks examine metadata, type patterns, and hashes; they do not execute content or provide an exhaustive malware verdict. Read the coverage limits.
Can I connect my whole organization?
The documented SMTP pilot uses explicitly assigned recipients, credentials, and delivery routes. Creating an account does not provision company-wide mail protection. New organizations need operator setup and independent validation. Model availability and quotas also bound operation; see availability and pilot scope.