WEBVTT

00:00:00.166 --> 00:00:01.970
A deleted-without-being-read notice can raise

00:00:01.970 --> 00:00:03.052
an evidence-preservation question.

00:00:03.052 --> 00:00:06.299
It does not prove who deleted a message, why,

00:00:06.299 --> 00:00:08.464
whether a person reviewed it elsewhere,

00:00:08.464 --> 00:00:10.629
or that a law was violated.

00:00:10.629 --> 00:00:11.711
Verify five layers.

00:00:11.711 --> 00:00:14.237
First: preserve the notice and message headers.

00:00:14.237 --> 00:00:16.402
Second: record the message ID, sender,

00:00:16.402 --> 00:00:17.485
recipient, and timestamps.

00:00:17.485 --> 00:00:20.371
Third: identify the mail system and disposition code.

00:00:20.371 --> 00:00:22.535
Fourth: compare server logs, mailbox rules,

00:00:22.535 --> 00:00:24.700
retention settings, backups, and case records.

00:00:24.700 --> 00:00:27.586
Fifth: document what can and cannot be concluded.

00:00:27.586 --> 00:00:29.751
Internet standards say a disposition notification

00:00:29.751 --> 00:00:32.637
reports a mail-system event; it is not guaranteed

00:00:32.637 --> 00:00:34.802
and may be generated by software.

00:00:34.802 --> 00:00:38.770
A missing or deletion notice is a lead, not a verdict.

00:00:38.770 --> 00:00:41.296
Preserve native files before screenshots or exports.

00:00:41.296 --> 00:00:43.461
Read the source-linked record at david-medeiros.com.