Hash the raw message before transforming it
A technical evidence record should start from the raw message rather than a screenshot or rendered view. Calculate a cryptographic hash over the exact bytes or text representation being preserved and record the byte count. If the message is later normalized, decoded or exported into another format, keep the original hash so every derived artifact can be distinguished from the source.
Record the header as a separate evidence surface
The message header contains sender identities, Message-ID, Authentication-Results, DKIM signatures and Received fields that can explain delivery and provenance. A separate header hash makes it easier to identify whether a later analysis used the same header even when body handling differs. It does not make untrusted header fields authoritative; it only fingerprints what was supplied.
Summarize identity and transit without executing content
Extract From, Reply-To, Return-Path, signing domains, authentication results and Received hops as structured data. Remote images, tracking URLs and linked content should be inventoried as text rather than fetched during evidence creation. That avoids changing the external environment or notifying a tracker merely because the evidence was opened.
Capture MIME and attachment metadata conservatively
Content types and attachment filenames help explain what the message contained, but filename text is not a security verdict and can be misleading. For deeper malware analysis, attachment bytes should be handled through a separate controlled workflow. A manifest can still document the MIME surfaces that deserve follow-up without executing or rendering them.
A generated manifest is not formal chain of custody
A web tool can document the properties of the supplied message at analysis time, but it cannot prove who originally collected the file, whether the source mailbox was altered before export, or who handled the evidence afterward. Preserve the original file in the organization’s approved evidence process whenever legal, regulatory or disciplinary decisions depend on it.
Use manifests to compare and hand off technical findings
A compact JSON manifest is useful when one analyst needs to hand evidence to another team without rewriting every observation. Compare hashes to confirm both teams are reviewing the same supplied artifact, then use identity, transit and MIME metadata as pivots into header forensics, incident reconstruction or BEC review. Mailybox keeps the manifest bounded to evidence it can derive from the supplied message.
Verify the evidence
Use the live analysis that matches this workflow instead of relying on a generic status check.