TECHNICAL ENQUIRY: Discrepancies in Microsoft Exchange / Outlook Web App (OWA) Print Layout and Metadata Rendering

Hi @PhilipJackson-7629

I’m not an expert in digital forensics or Exchange message authentication, but from my perspective, I would distinguish between the underlying email message and the way that message is displayed, rendered, or printed.

For the From: display name, Outlook/Exchange messages can contain separate properties for the sender’s display name and email/SMTP address. However, I am not aware of a documented native Outlook or Outlook on the web print function that, simply because Print or Print to PDF is selected, re-queries the GAL and rewrites the historical sender information to insert additional middle names. A different displayed name could therefore result from a client, directory, or address-book presentation difference, but it should not automatically be interpreted as Exchange modifying the original transmitted message.

For the CC recipients, I would also avoid assuming that the sequence displayed by a particular Outlook client is necessarily a literal reproduction of the original MIME Cc: header. Different message representations and clients can use recipient properties differently when presenting a message.

The logo and OWA icon are somewhat different. A browser or OWA-related icon could appear depending on how the content was captured, printed, or converted, so its presence alone would not demonstrate that the message was manually altered. Similarly, an organization's logo could originate from the original HTML message, a mail-flow disclaimer/signature, an organizational template, or another document-production layer.

However, I would not normally expect standard Exchange/OWA printing to take an arbitrary incoming email and automatically add a third-party organization's logo to the message header if that logo was not already part of the message or the system used to produce the document.

Therefore, these visual differences do not by themselves prove that Version B was manually reconstructed, re-keyed, or falsified. However, they suggest that the two documents may have been produced through different clients, rendering methods, templates, or document-production processes.

If the objective is to determine whether the underlying email itself was changed, I would compare the original electronic message data rather than relying on the appearance of printed pages or PDFs. In particular, I would examine the raw MIME/Internet headers and values such as Message-ID, Date, From, To, Cc, and Received, together with the MIME structure, HTML content, attachments, and embedded images.

If those underlying values are consistent and only the visual presentation differs, that would support the explanation that the discrepancy arose during rendering or document production, rather than from modification of the transmitted message. If the underlying message/header data also differs, then the provenance of the second copy would require further investigation.

Again, I’m not a digital-forensics expert, so if this is intended to establish authenticity for legal or evidentiary purposes, I would suggest having the original electronic messages examined by someone professionally qualified in email/digital forensics rather than drawing a conclusion from the two rendered copies alone.