When investigating email, we usually start with the piece of email itself and analyze the headers of the email. Since each SMTP server that handles a message adds lines on top of the header, we start at the top and work our way backward in time.
Digital communications, especially emailing has become a prominent way to interact in a personal and professional life. The substantial usage of emails has outgrown to a level where cybercriminals too have misused this communication technology. Initially the email protocols were safer but now cyber crime has been indulged in spam mails, phishing, spreading viruses, hoaxes, etc. Email forensics is necessary to take out hidden evidences from these emails to track the records of crime.