ngoing_Investigation..msg; Fwd:_U.S._Department_of Justice_investigation.msg There are two chains that I believe capture everything. The first (Fwd: U.S. Department of Justice Investigation) I believe captures everything from initial outreach to the last email, which is the second attachment (FW: DOJ ongoing Investigation). EFTA000234