Usually yes. Email messages contain header data that includes date and timestamp information not controlled by the email end user. If full header data is recovered, an examiner can cross-reference the available date and timestamps to ensure they are accurate.   Email is typically stored, sent, and received in chronological order. Examiners may check adjacent messages in the email file to discover if any messages appear out of place or in an odd order. For example, you wouldn’t expect to see a message purported to be from a year ago to show up in your inbox today.   Large email ISPs like Google (Gmail) or Microsoft (Office 365) have robust logging and support to assist in forgery investigations. It may take a preservation letter and subpoena to obtain email and logs. Time is of the essence when dealing with opposing parties and ISPs.