How about ZERO!
these were pulled from backup tapes and will likely be exported mail files in .PST format. If it was easy or routine to modify these, Businesses would have been doing in for years to avoid lawsuits. You cannot simply modify a mail store without leaving a trace, especially when its off of a backup. There will likely be forensics work in place to prevent ANY tampering or even the chance of it appearing tampered.
For forensic work like this, you use a Write blocker, when transferring or examining data.
That was helpful info. Thanks.
Not to mention those emails will have message headers with timestamps, messageids, bytecounts, and thread indexes that would all have to be modified to match any changes made to the messages. I don’t think that bunch of affirmative action union drones is that good.
By comparing the “hash values” it should show if the files have been changed.