Circumstantial evidence generally provides the key to establishing the authorship of a computer record. In particular, distinctive characteristics like email addresses, nicknames, signature blocks, and message contents can prove authorship, at least sufficiently to meet the threshold for authenticity.
United States v. Safavian, 435 F. Supp. 2d 36, 40 (D.D.C. 2006)
Emails between defendant government official and lobbyist were authenticated by distinctive characteristics under Rule 901(b)(4) including email addresses which bore the sender’s and recipient’s names; “the name of the sender or recipient in the bodies of the email, in the signature blocks at the end of the email, in the ‘To:’ and ‘From:’ headings, and by signature of the sender”; and the contents).
Note: These cases can be found in DOJ’s “Searching & Seizing & Obtaining Electronic Evidence Manual.”