Spam and spoofed emails have become a part of the daily reality delivered as messages to a persons inbox. Spam has become a profitable enterprise for many marketers and is a point of contention for those who receive it. However, spoofed email has become more than just a nuisance; it is a viable security threat to individual home users, organizations, and businesses. Terrorists and cyber criminals use them to communicate with each other or to threat governments and civilians. More sophisticated suspects and terrorists will fake the origins of their e-mails by using e-mail programs that strip the message header from the message before delivering it to the recipient or in other cases, the From line in a message header is faked.

Email forensics is part of computer forensics which is the study of source and content of electronic mail as evidence. Its very important for an investigator to study them in order to trace them back and reveal the real sender. Email can be spoofed with great sophistication, and it is imperative that individuals are able to distinguish well-spoofed messages from legitimate ones. There are numerous tools and techniques that can be used to trace the origins of a spoofed email message. It was the objective of this paper to discuss the most widely available tracing tool such as nslookup, Whois, traceroute and SamSpade in revealing the origin of the spoofed IP address in the email header. It was concluded that a forensic investigator should not depend on one tool for results but must always seek for updated tools and different methods for tracing the process.