In an email crime investigation, the workflow should begin withseizing the computer and email accounts (5)to preserve evidence and prevent alteration, deletion, or continued misuse. This includes securing endpoints and ensuring account access is maintained under proper authority. Next, investigators proceed withacquiring the email data (1)using forensic methods (logical export, mailbox acquisition, or forensic imaging of local mail stores) to maintain integrity and chain of custody.

Once the data is preserved, investigatorsexamine email messages (3)to identify relevant communications, context, attachments, and indicators of fraud, harassment, data leakage, or impersonation. After identifying emails of interest, investigatorsretrieve email headers (6)(full headers, not just what the mail client displays) because headers contain routing metadata required for attribution and timeline reconstruction. They thenanalyze email headers (2)to interpret fields such as Received lines, Message-ID, originating IP clues (where applicable), sending infrastructure, and authentication results, which helps determine spoofing, relay paths, and sender legitimacy. Finally, theyrecover deleted email messages (4)from mail stores, server-side retention, or unallocated space to restore missing evidence. This sequence matches optionA.