Investigation pathway

I have been given a suspicious email

Use this route to preserve the original material, identify account and delivery questions and avoid assuming that the visible sender wrote or sent the message.

3 core questions Optional video-ready Reusable cards, not duplicated lessons

1

Orientate

Establish what the email may contribute

Start with the investigative purpose, the form of the material and the immediate preservation risk.

[Open EML-014](../library/email-evidence/EML-014_ive-been-given-an-email-that-may-be-relevant-to-an-investigation-what-can-i-do-with-it.md){ .ifd-step-link }

2

Interpret account use

Consider shared or delegated mailbox access

Separate the mailbox, visible sender and person who may have used delegated permissions.

[Open EML-023](../library/email-evidence/EML-023_what-changes-when-a-shared-mailbox-send-as-or-send-on-behalf-access-is-used.md){ .ifd-step-link }

3

Preserve

Use the email preservation checklist

Retain the original message, attachments, headers, mailbox context and relevant provider-held records.

[Open EML-043](../library/email-evidence/EML-043_email-preservation-checklist.md){ .ifd-step-link }

Pathway outcome

Preserve first, then test the sender claim

The visible message is one part of the enquiry. Account access, delivery infrastructure, mailbox records and corroboration may all matter.

[Browse email evidence](../library/email-evidence/index.md){ .ifd-button .ifd-button-secondary }