EMAIL FORENSIC INVESTIGATION

Email threat detection & forensic evidence analysis.

Start with the evidence you have. VeriTrustLab preserves the difference between pasted content, raw message evidence, and facts observed directly at a trusted SMTP boundary.

Check an email

Investigations run in a signed-in workspace. Sign in to investigate an email.

Use a raw .eml export when you need message-carried authentication, identity, MIME, attachment metadata/hash, and relay evidence.

Email subject optional

Email message

This checks the wording and extracted links. Upload a raw .eml export to evaluate message-carried authentication/alignment and sender-identity evidence, plus attachment metadata and hashes.0 / 12,000

Stay cautious. No automated result can guarantee that an email is safe.

How evidence levels affect an investigation

Progressive Evidence Escalation™Start with the evidence you have. Stronger acquisition unlocks stronger claims without rewriting the earlier stage.

01Pasted textContent, AI & visible links

02Raw .emlMessage-carried headers, identity, MIME, attachment metadata/hashes & recorded relays

03Trusted receiverDirect SMTP facts & trusted boundary

Need trusted SMTP evidence? Open your connected receiver →