TL;DR
| Key Point | Explanation |
|---|---|
| Forwarded email ≠ original email | Courts ruled that forwarded EML files are "not original emails" and their content authenticity is not recognized |
| Three hurdles for court review | Authenticity, relevance, legality — Articles 93 and 94 of the New Evidence Rules are the core basis |
| 30-minute preservation checklist | Export EML → Copy email headers → Compute hash → Timestamp notarization, costing 10–20 yuan |
| Notarization isn't the only option | Article 11 of the Internet Court Provisions confirms the validity of hash + timestamp, supported by numerous precedents |
One Email Can Decide a Lawsuit
You have an email where the other party agreed to extend payment. You submit it to court with confidence. The opposing lawyer asks: "Is this the original email? Can you log into your mailbox and show us?" You freeze — that email was forwarded from Outlook to your personal inbox for safekeeping, and the original was deleted from the company server.
You lose the case. One forwarded email, a lesson worth a million.
The Shanghai No. 1 Intermediate People's Court made it clear: an EML file is a format converted during archiving, "clearly not the original email," and its authenticity cannot be confirmed. The Jiangsu High People's Court went further: even if a forwarded email is notarized, only its formal authenticity is recognized — the EML file can be edited and modified, so its content authenticity is not accepted.
The court's review of email evidence hinges on "three thresholds" — authenticity, relevance, and legality. Is your email still on the server? Did you preserve the email headers when exporting? Did you perform technical notarization? These details determine whether the email is solid proof or worthless paper.
The Court's Three Review Requirements
Authenticity (the core challenge): Article 93 of the New Evidence Rules requires judgment on three levels: whether the medium is original, whether the data is complete, and whether the content is authentic. Article 94 lists six scenarios where authenticity can be presumed, including records formed during normal business activities, those provided by neutral third parties, and those that are notarized (which the court shall confirm).
Relevance: Confirm that the sender and recipient are parties to the case. It's recommended to specify the contact email in the contract.
Legality: Emails obtained by illegally hacking into systems or intercepting them without authorization cannot be used as evidence (Civil Procedure Law Judicial Interpretation, Article 106).
Forwarded Emails Are the Biggest Evidence Trap
A forwarded email leaves the original server and becomes an "orphan email" — anyone can edit the body, replace attachments, or modify timestamps without leaving a trace. An experiment by the Huojia County Procuratorate in Henan Province confirmed that forwarded emails can be fabricated manually, replicating the page appearance without an actual forwarding process.
Actions that undermine evidence validity: forwarding emails, saving as HTML/PDF, taking screenshots, downloading via POP3 (which deletes the email from the server), and saving after modification. Best practice: use the IMAP protocol to keep emails on the server and save the original EML format.
Email Headers and DKIM Verification
The Received chain in email headers records the IP and timestamp of each relay server. Reading from bottom to top reconstructs the transmission path. DKIM (DomainKeys Identified Mail) is the digital signature of an email — if the content is altered, verification fails. The Technical Specification for Email Authentication (SF/T 0156–2023) has incorporated it into the standard authentication process.
30-Minute Preservation Checklist
- Lock down the scope (2 minutes): Confirm the email hasn't been deleted
- Copy email headers (5 minutes): Log into webmail, click "Show original," save as a .txt file
- Export EML (3 minutes): Save in the original EML format — do not forward and save
- Compute hash (5 minutes):
sha256sum(Mac/Linux) orGet-FileHash(Windows) — the hash is the file's "digital fingerprint"; any modification changes it - Timestamp notarization (5 minutes): Upload the EML to tsa.cn to obtain a timestamp certificate issued by the National Time Service Center
- Notarization (recommended for key evidence): Have a notary office preserve it — this carries the strongest weight (New Evidence Rules, Article 94)
- Create an evidence catalog (3 minutes): Name files consistently, e.g.,
YYYY-MM-DD_Sender_Subject.eml - Backup (2 minutes): Copy to another hard drive or USB stick
Low-Cost Solution: Hash + Timestamp
For businesses on a tight budget, hash + timestamp costs only 10–20 yuan per use. Legal basis: Article 11 of the Supreme People's Court's Internet Court Provisions. Numerous precedents support this: the Langjiu case (190 million yuan, 78 timestamp certificates), the Huagai v. Tuniu case, and a 2024 case from the Chengdu Intermediate People's Court.
Note: Timestamps only prove formal authenticity (the data hasn't been tampered with), not substantive authenticity (whether the content itself is true). It's recommended to supplement with supporting materials like operation screen recordings and device cleanliness inspection records.
Start Now
The best time to preserve email evidence is the moment you receive it. Forwarding is not saving — EML export + hash + timestamp is. If you don't preserve it today, it might be deleted tomorrow. Logging in and demonstrating in court is the most powerful way to verify — but only if the email is still on the server.
Only those who know how to preserve evidence are qualified to win. Start now, with the most important email in your inbox.
