The collection of system forensics evidence is governed by the general rules of criminal evidence. As such, it is subject to a number of well-established and formal steps. As a pervasive form of communication and commerce, e-mail also presents many opportunities to facilitate criminal activities.
a. How would you proceed with your investigation? Explain what steps you would take to examine the e-mail messages.
b. Analyze the information that might be useful to your investigation from looking at the headers of the e-mail messages.