Can an email's date and time be falsified in Outlook?

Question

I received a copy of an email that shows the date and time it was sent and to whom it was sent. I have reason to believe this is not a true email.

Can it be proved that the date and time sent was changed and then a false copy was sent to me?

Answer 1

Can it be altered? Yes.

Can it be proven? No. Maybe. It depends.

In theory someone could modify the time on their computer and send an email, but every mail server it passes through should add a header stating where it was received from along with the date.

In Microsoft Outlook you can view the full headers by double-clicking the email (to open it in its own window) then going to File and selecting the Properties icon. This should show the details of the email, along with the raw headers.

Look for Received: headers showing the server names and dates the email passed through the server and see if the date matches The Date: header.

---

An email is essentially just a text file containing some "to", "from" and date information attached as a header.

Until a couple of years ago where it became more common to encrypt data between email servers they were sent in what is known as plaintext, as in the contents were bare text and readable by anyone who owned a server that the email passed through. It is feasible that the email could also be transparently modified as it passed through with neither the sender or receiver knowing unless they printed it off and compared it.

Some servers still don't support encryption and it is difficult to know for sure if your email went through one that isn't encrypted and got modified on the way.

Given access to your mail server a malicious IT admin could also potentially modify email dates and times, making it more difficult to detect.