• ID: AF027.008
  • Created: 15th November 2026
  • Updated: 15th November 2026
  • Contributor: The ITM Team

Delete Emails With Rules

A subject creates or modifies automated email rules to delete incoming messages that may provide evidence of their activities or involvement in an infringement. These rules may target emails based on sender addresses, subject lines, keywords, or other message characteristics, automatically deleting matching communications upon receipt.

 

The subject may use these rules to suppress security notifications, conceal communications with third parties, or remove other potentially incriminating messages without requiring manual intervention. Depending on the email platform and rule configuration, messages may be moved to deleted or recoverable item locations, or permanently deleted where supported.

 

This technique may hinder investigations by preventing relevant communications from appearing in the subject's inbox and reducing the availability of evidence during subsequent mailbox examination.