g another major tool in the email forensics toolkit is checking the mail user agent, or email client, being used to generate the email. legitimate companies should be using up-to-date email clients. using the contents from email header