forensic investigation part 1 preparing for a forensic investigation part 2 analyzing an e mail archive for an electronic discovery investigation part 3 analyzing evidence from mac os x