Server logs edited or deleted

Question

I am asking about methods to verify the origin and to validate the contents of an email. Can my employer manipulate their email server to suit their own interest, meaning: Can my employer delete proof that an email was ever generated or sent, The situation is that my employer sent me 6 emails that have become very incriminating to the employer/business, my employer is now saying that the emails never existed or sent, can I prove that they did exist or were sent or can my employer simply delete all evidence that the emails were sent (all I have are the print outs of the email which my employer is saying are forgeries).

Answer 1

Yes, it is technically possible for your employers staff to manipulate logs on their own mail server. That said this is not something they can trivially do, nor is it something that can really be done if they rely on a (reputable) third party used for sending/receiving mail.

A bigger problem may be finding these mail logs and having them preserved. Most systems would not keep logs for more then a few weeks.

To verify the origin of an email you need access to the email headers which tell you exactly how and when it was delivered, and by what computer. Without this it may be possible to get info but you are fighting a loosing battle.

Its worth noting that there will be more of an audit trail - and one that is harder to erase - if the email is sent between providers - each provider a mail goes through could have a seperate log. Of-course, a log will generally evidence who corresponded and maybe (but not always/often) the subject, but nothing about the contents.