7

I tried to access an old E-mail to print for a court case only to find there is no content. I checked on all my devices and outlook account. The E-mail in question is from a gmail user and I have subsequently learned there are ways to get the content to self destruct. This single, most damning E-mail is the one that is missing its message content.

Is there a way to analyse the header to determine if there was some self destruct/expiration setting. For clarification, this was not an attachment, but a body of text that appeared as a normal E-mail message from the sender.

techraf
  • 9,141
  • 11
  • 44
  • 62
TheAlpine
  • 71
  • 2
  • https://support.google.com/groups/answer/75960?hl=en – makerofthings7 Jul 24 '16 at 04:16
  • 12
    Email messages do not self-destruct, but they could be linked to external resources one way or another that do. The simplest example would be to send you an image tag, which links to a website, that represents the full message. That image could get removed from the website beyond your control. – Julie Pelletier Jul 24 '16 at 04:28

1 Answers1

24

Emails, sent through SMTP, have no way of "self-destructing" internally built in to them. They're basically just text files that hang around for eternity until all copies are manually deleted. The fact that you still have the email's headers is proof enough; if messages could self-destruct, their entry would be entirely removed from your mail client, as if they never existed.

However, there is a way to destroy the body of an email: simply have the email point to an external inline image, then later delete the image. In short, the body of your email might look like this (HTML sourced):

<img src="http://www.example.com/message-images/012345.jpg" />

Thus, when you first open the email, your client displays the image, which appears to be just plain text to a layman. The only obvious hint that it is not text would be that you can't "copy and paste" it, but it'd still be printable, etc. Some clients will warn you about inline images, because that itself is a security risk (at minimum, you can presume that the author now knows you've opened or scanned the email).

Finally, the author simply needs to delete the original image file. Once deleted, clients would probably display nothing or perhaps a "broken image" icon. Alternatively, they could switch the image out for a 1x1 transparent pixel, which would render as... nothing.

You could, however, view the source of the email (see your client's help documentation on how to do this), then find the image link, as described above. From there, you might do a Google search; if it's cached by Google, you might be able to recover the source from there. Of course, if the image was hosted without a domain name (e.g. stored by IP address), you might be entirely out of luck.

Tom
  • 880
  • 1
  • 7
  • 14
phyrfox
  • 5,724
  • 20
  • 24