When technology-facilitated gender-based violence occurs, maintaining a record of events is important for criminal and civil legal matters. Email messages, whether accessed through a computer or a mobile device, are a common form of communication. In many family law agreements, courts routinely order email communications as a means of “safe” communication between parties, as it leaves a written record. However, an abuser can misuse email by sending harassing messages, gaining unauthorized access to your email, creating fake email addresses to monitor or impersonate you, or sending computer viruses or spyware via email. Email evidence can be used to strengthen contested cases by providing proof of abuse and presenting a picture of the abusive relationship and domestic violence. This document provides information on how to preserve emails as evidence in these circumstances.  

If you plan to use email evidence in a court proceeding, you will need to authenticate your evidence in court. For more information about digital evidence and authentication, see Authentication of Digital Evidence.  

Safety Check

Before you decide whether to preserve emails as evidence of abuse, you need to consider potential risks to your safety. If you are saving email evidence to your smartphone or computer, there may be a risk that the perpetrator is monitoring the activities on your device. This could be happening in several ways. Your smartphone could be monitored if the perpetrator has physical access to your device, such as if you share a home, or if you share your passwords with them. If the perpetrator knows your cloud storage (e.g. iCloud, Google Drive, or Dropbox) ID and password, they will have access to your files, photos, and videos. It is also possible for the perpetrator to be monitoring your smartphone or computer via mobile spyware such as stalkerware. If the perpetrator is monitoring your device these ways, recording and saving video screen recordings could alert them to the fact you are collecting evidence.  

If you suspect that the perpetrator has access to your devices, accounts, or files, you will need to make a plan for how to avoid detection when collecting evidence. This is both to protect you from additional abuse and to avoid the risk of the perpetrator deleting important evidence. For more information, see Safety Considerations for Preserving Digital Evidence, and consider speaking to an anti-violence organization (See Technology Safety and Victim/Survivor Resources).

Email Evidence: The Digital Trail

While email evidence can be extremely useful, it is not always properly preserved, and it can get accidentally deleted or have its authenticity questioned. Admitting email evidence generally requires showing that an email is relevant to your case and that a specific person authored and/or sent it.

What to Include in Email Evidence

  1. The Email Message. You can save a copy of an email using the print function, which can create a physical copy (if you print the email from a printer) or a digital copy (if you select “Save as PDF” from the printer options). Printing the email will show the To, From, Date, and Subject information like the image you see below. A printed email will also show the file name of any attachments. When printing an email, it can change how the email looks, which can make it harder to admit the email in court. If the email changes when you print it, you might want to take a screenshot and then print the screenshot instead.

    Screenshot of email


  2. The Header. What you see in an email is often not all of the information available in that email. A lot of information is hidden in what is called the “header,” which has information about the IP address (an individualized code that can help to show who sent an email). When printing emails for court, make sure to print the email with the email header. To find out how to print emails with headers, do an online search for “How to print email header in [name of email provider (e.g. Outlook, Gmail, etc.)]” and follow the instructions.

    Email headers might open in a text editor or browser window. Saving the digital file to a readable file format (such as .txt, .doc, or .pdf) is recommended for the preservation of data. Below is an example of an email header from a Microsoft Outlook email address.Screenshot of email header


  3. The IP Address. Once you have the printed email header, look for the “received” IP address. It will be a long code. You can take that code and enter it into an IP address search on an online search service. Generally, it will provide you with a map that shows where an email was sent from. This will not work with all emails, but it will work for many emails.

    Note: Tracking an IP location will only narrow the location down to a specific city, not an exact address (a warrant is needed for exact locations). Additionally, IP addresses can be easily masked so it might not actually help you identify who sent the email.
  4. Evidence of Who Sent the Email. If you are receiving email from someone using a fake email address, what is written in the email may help indicate who sent it. If you have multiple emails from one fake email address, you can print all of them to help show that the different emails are from one person by establishing common patterns, themes, or word/sentence/phrase choices in the communication. If these words/sentences/phrases are similar to those used by a specific individual who you think might be sending the emails, you will want to gather evidence of this as well. For example, if you think the anonymous e-mails are coming from your former partner because the word “over” is misspelled as “ovur” and this is something your ex always does, you will want to save examples of previous emails or text messages sent by him containing this error. These previous emails or text messages can help you establish it was your former partner who sent the anonymous messages in court.
  5. The Original Email Message. If you want law enforcement to investigate your emails as evidence in a criminal case, you mustn't delete the emails. You should keep the original email messages in the email account for clarity.
  6. The Entire Thread. Print all the emails of the same conversation or “Subject.” Most courts will want to see the entire conversation thread, not just one “reply” to a larger conversation. It may be helpful to start new email conversations or “Subjects” for separate conversations instead of replying to the same email thread for long periods of time.
Safeguarding Email Evidence 
Keep any saved emails you plan to rely on as evidence in a safe place. Remember to back up a copy of the file on a secondary device or storage space. File storage options will depend on your circumstances. For more information, see Preserving and Storing Evidence of TFGBV: Best Practices and Safety Considerations for Preserving Digital Evidence.

Technology-Facilitated Gender-Based Violence (TFGBV) is part of a continuum of violence that can be both online and in-person. If you or someone you know is experiencing TFGBV, you are not alone. You can use sheltersafe.ca to find a shelter/transition house near you or call/text the Kids Help Phone to discuss options and create a safety plan. You don’t need to stay in a shelter to access free, confidential services and support.

We gratefully acknowledge Moira Aikenhead for providing expertise to update this toolkit.   

Adapted with permission from BCSTH’s Technology Safety project, based on their resource How to Preserve Emails as Evidence. Adapted for Canada with permission from NNEDV’s Safety Net project, based on their resource Legal Systems Toolkit.        

Safety Check!

If you think someone is monitoring your devices, visit this website from a computer, tablet, or smartphone that isn’t being monitored.

EXIT NOW from this website and delete it from your browser history.

Exit Site