date on email

[Richard Darling]

Our owner was sent a copy of an email and was told that is was orginally sent to him on July. Is there a simple way for the sender to modify the sent date of the original email, or create an email and have it back dated to July?
RD

[harry d brown jr]

Yes it is possible and it's done quite often by spammers, so they show up at the top of one's email folder (If sorted by date).

Look at the raw data to see when your mail relay servers received it, that will be the correct time and date.

live free or die
harry

[Richard Darling]

Hi Harry,
He was sent a copy of the orginal email by the sender. he doesn't have the original email.
Is there a way to tell if the date has been changed if the user deleted the original email and has been forwarded a copy of it form the sender's sent items?
Thanks.
RD

[harry d brown jr]

Richard,

Open his mail, which is hopefully netscape, and look at the message source. A lot of headers remain in a message, unless of course the sender simply cut and paste'd the "body" of the email.

if it was sent over the internet, maybe the FBI has a copy of the original?

:-)

live free or die
harry

[Richard Darling]

Thanks for the humor Harry...
RD

[W.C. Epperson]

The "Received:" headers for the resend offer some plausible information about the time of the resend, but the headers in the originally sent message are trivially forged or altered with a text editor (and even the resend headers can be simply, if not easily, forged by hand-rolling an SMTP transaction--in that case only the last "Received:" header will be reliable). And even if the message were sent in July, that's no indicator that it was delivered. Your mail server logs could tell you that if you have them.

[Frank Slootweg]

Ask the original sender to *forward* the original message *including* the original headers [1]. That probably means that the original sender should have a real mail system instead of something like Exchange+Outlook, because that (E+O) normally is incapable of showing the original headers.

As others have mentioned, most of the headers are easy to forge, but sometimes a knowledgeable person can tell if they have been forged.

Please feel free to post the original headers (as an attachment), so we can have a look at it.

[1] With "headers" I mean the *real* headers, not the Outlook (or similar) pseudo headers like:

> -----Original Message-----
> From: ...
> Sent: ...
> To: ...
> Subject: ...

because that is just text, nothing more.

[Richard Darling]

Thanks for the replies. It is from O+E and the header gives little information. His email comes in on a server at the main facility in PA, not here in MA; so I asked them to check their logs for that day, if available. If they aren't available I suggested that they retrieve his email from backups for that day, if available.
RD