Sample assessment
What we will and will not say.
An assessment states what has been established about a message, what has not, and where the line between the two falls. This is a complete one, so you can see the form before you rely on it.
The matter is invented. The correspondence below is a fixture, addressed to domains that cannot exist. Publishing a client's correspondence as a specimen is a disclosure we have no right to make, and inventing a client would be worse. No customer, case or result is claimed on this page.
The question put
Can this be relied on?
A client forwards a supplier invoice and asks the firm to pay it. The claim being tested is that the attachment on the forwarded message is the attachment the supplier sent.
One forwarded message, exported by the client from their mailbox as an .eml file.
The answer
Inconclusive on this evidence.
The material supplied cannot settle the question. That is not a finding against anyone, and it is not a failure of the examination: it is the examination declining to go further than the evidence goes.
Why
The signature did not survive the forward.
- The file supplied is a forwarded copy. Forwarding an email rewrites it, and the rewriting destroys the signature the sending server attached — the one thing capable of showing that a message is unaltered. What arrives after a forward is a faithful rendering of the words, and no longer a copy of the thing that was sent.
- Because that signature is absent, no test of it was attempted. An examination that runs a test the material cannot support, and then reports the failure, produces something that reads like a finding of forgery when nothing of the kind has been found. We would rather return an open question than a misleading answer.
- The file was received, recorded and fixed in time, so that it can be compared with a proper copy if one is later produced. That much is established and is not in doubt.
What was done instead
Two copies, compared by fingerprint.
- The holder of the original was asked for their copy, and supplied it. Where two copies of the same message exist they can be compared directly, and that comparison does not depend on any signature having survived.
- Every attachment on both copies was reduced to a cryptographic fingerprint — a short value that changes completely if a single character of the file changes, and which two different files cannot share. The fingerprints were then compared.
The copy your client was sent
8790a9619876e53ed31d536f146ae9af78118f2ad7e7ef19f514766528b12531
The copy the sender still holds
b79d12d890e62e1d3da95b659594f4fcc69c2c90b1065a9066aab213d7a89c16
The boundary
What this establishes, and what it does not.
Established
- The attachment on the copy your client received is not the attachment the sender holds. That is a statement about two files, and it is made with certainty.
- Everything a person can read agreed — the sender, the recipient, the subject and the wording were the same on both copies. Had the comparison rested on reading them, it would have found nothing at all.
Not established
- Who changed the attachment, when, or why. Nothing here bears on that, and nothing here should be read as suggesting an answer.
- Whether any person named acted improperly. That is a judgement, and judgements of that kind belong to those accountable for making them.
- Whether the message as a whole is genuine. The signature that would have shown it did not survive the forward, and no further examination of that file will bring it back.
Responsibility
Where we stop, and you begin.
Ours is to say what the material shows, in terms that do not overstate it, and to say plainly where certainty ends. Where we are not sure, we do not say it — and the answer above is an example of exactly that, since the question originally asked remains open.
Yours is what follows. This assessment is not legal advice and is not an expert report. It carries no approval from any court, regulator or government body, and none should be inferred.
Technical record
Kept because an assessment nobody can check is worth less than one they can. None of it changes what is said above.
- Source grade
- REPRESENTATION_ONLY
- Outcome
- NOT_VERIFIED
- Reason codes
- SRC_ABSENT · SIG_DKIM_ABSENT
- Comparison codes
- CMP_ATTACHMENT_DIVERGENCE
- Fingerprint, file supplied
- ebf2a52b90755c1af2471601cc3ff6579c0dc5f64cfe7c005fda4975f53576ed
- Fingerprint, sender's copy
- 97c8b7c945c236fd68838b1da623d507f2d6ceefae5fcf621fee569c1d940fba
- Examined at
- 2026-09-08T22:15:04Z
- Ruleset
- policy-2026-09-08-v1
- Reference
- SAMPLE
Every value on this page was produced by running the software against a fixture held in our repository and copying the output. Nothing was written by hand. The fixtures and raw results are at evidence/phase-08/sample-assessment/.
An admitted organisation receives this as a dated record and as a PDF for the file, and the same content through the machine interface. Request access.