top of page

Email container files (.pst, or .nsf archive files) don’t usually contain email header file names (from; to; cc; bcc; subject). Processing software will assign the header field names, and often use English terms by default regardless of the content of the messages. So even if you have emails in one or more foreign languages, threading analytics tools should always have English as one of the selected languages.

Forensic tools exist which can analyze email headers to find the IP address of the computer a message was sent from, and also the geographic location it was sent from. eMailTrackerPro is an example of a tool which performs this task. eMailTrackerPro will help you track the origin of all emails in a particular account.


If you want to check the header of an individual email without software, you can use Google Toolbox's Messageheader, available here: https://toolbox.googleapps.com/apps/messageheader/


Input the header of the email into the toolbox, and click the option to analyze it.





You'll be able to lookup the location of the IP address and the associated ISP provider with online tools such as: https://www.iplocation.net/ip-lookup




When performing electronic discovery for web based email accounts, keep in mind that a outlook.com account may become disabled if a user has not logged in for more than 2 years. After this period, may not be possible to recover the data for the account at all. Outlook reserves the right to delete the data.


See the services agreement posted here.



OneDrive accounts will be closed after more than one year of inactivity. After a user voluntarily closes their email account, Microsoft will still permit it to be reactivated for another 60 days.



Sean O'Shea has more than 20 years of experience in the litigation support field with major law firms in New York and San Francisco.   He is an ACEDS Certified eDiscovery Specialist and a Relativity Certified Administrator.

The views expressed in this blog are those of the owner and do not reflect the views or opinions of the owner’s employer.

If you have a question or comment about this blog, please make a submission using the form to the right. 

Your details were sent successfully!

© 2015 by Sean O'Shea . Proudly created with Wix.com

bottom of page