This session will present specific background, tools, and techniques for conducting forensic investigations involving electronic mail. It will review the various information that can be gathered from the direct email evidence and discuss information available via subpoena from internet service providers. The session will conclude with a case study of an email investigation that will bring together the concepts discussed in the presentation.