1
00:00:00,166 --> 00:00:01,970
A deleted-without-being-read notice can raise

2
00:00:01,970 --> 00:00:03,052
an evidence-preservation question.

3
00:00:03,052 --> 00:00:06,299
It does not prove who deleted a message, why,

4
00:00:06,299 --> 00:00:08,464
whether a person reviewed it elsewhere,

5
00:00:08,464 --> 00:00:10,629
or that a law was violated.

6
00:00:10,629 --> 00:00:11,711
Verify five layers.

7
00:00:11,711 --> 00:00:14,237
First: preserve the notice and message headers.

8
00:00:14,237 --> 00:00:16,402
Second: record the message ID, sender,

9
00:00:16,402 --> 00:00:17,485
recipient, and timestamps.

10
00:00:17,485 --> 00:00:20,371
Third: identify the mail system and disposition code.

11
00:00:20,371 --> 00:00:22,535
Fourth: compare server logs, mailbox rules,

12
00:00:22,535 --> 00:00:24,700
retention settings, backups, and case records.

13
00:00:24,700 --> 00:00:27,586
Fifth: document what can and cannot be concluded.

14
00:00:27,586 --> 00:00:29,751
Internet standards say a disposition notification

15
00:00:29,751 --> 00:00:32,637
reports a mail-system event; it is not guaranteed

16
00:00:32,637 --> 00:00:34,802
and may be generated by software.

17
00:00:34,802 --> 00:00:38,770
A missing or deletion notice is a lead, not a verdict.

18
00:00:38,770 --> 00:00:41,296
Preserve native files before screenshots or exports.

19
00:00:41,296 --> 00:00:43,461
Read the source-linked record at david-medeiros.com.