Collect the smallest complete sequence that explains the event
A useful timeline does not need an entire mailbox. Start with the messages immediately before the disputed request, the request itself, replies, forwards and any follow-up that changed payment, credentials or delivery instructions. Preserve raw messages or raw headers whenever possible because screenshots usually omit Message-ID, authentication, routing and timestamp evidence needed to compare identity continuity.
Normalize timestamps but keep supplied order visible
Date headers can be useful for human chronology but they are sender-controlled. Received timestamps are added by mail systems along the path and can provide stronger transit context, although time zones, malformed headers and forwarding can complicate parsing. A reconstruction should therefore state whether it sorted by parseable message dates or retained the investigator’s supplied order, rather than silently inventing precision.
Create a snapshot of identity for every message
For each message record the visible From address and display name, Reply-To, Return-Path, DKIM signing domain, Message-ID domain and receiver-stamped SPF, DKIM, DMARC or ARC results. The objective is not to demand that every field remain identical. It is to create comparable snapshots so a legitimate platform migration, alias change or suspicious domain substitution becomes visible at a specific point in time.
Score transitions between adjacent messages, not the whole thread at once
Comparing only the first and last message can hide where the actual change occurred. Evaluate message one against message two, then two against three, and continue through the sequence. A sharp change in From domain, Reply-To destination, signing identity or authentication state creates a pivot point for investigation. Stable transitions before and after that point help isolate the event that deserves the most attention.
Keep content indicators subordinate to identity evidence
Urgency, invoices, wire transfers and bank-account language are relevant in a BEC investigation, but the same words appear in legitimate business mail every day. Use them to prioritize verification, not to classify a message automatically. The strongest timeline combines content context with a concrete identity change and, where available, independent business records such as the supplier’s known contact details or payment procedure.
Document what the timeline cannot prove
A compromised legitimate mailbox may preserve From, DKIM and Message-ID patterns perfectly. Conversely, a legitimate forwarding or vendor transition can alter several fields. A defensible reconstruction states those limits explicitly. Mailybox’s timeline tool highlights the strongest adjacent-message transition and leaves the final business or security decision to evidence outside the email when the case requires it.
Verify the evidence
Use the live analysis that matches this workflow instead of relying on a generic status check.