email investigation workflow