Read the record in context
The visible From address and subject are only part of the message. An examiner considers the complete source, the receiving environment and the point at which a field was added. Header names alone do not make their contents reliable. Keep the native file alongside any readable report so another examiner can test the interpretation.
Follow the trusted boundary
SMTP servers normally add Received trace fields as they handle a message. Earlier-looking entries can already be present when a system accepts it. The investigation therefore works from known infrastructure and corroborating logs rather than assuming that every line describes a genuine event. A gateway address may identify infrastructure, not the sender's personal computer.
Ask a precise question
If the dispute concerns delivery, obtain the recipient-side record and available transport information, not only a sender's Sent Items copy. If it concerns alteration, compare the relevant body, attachments and signing information. Apparent header inconsistencies should be tested against ordinary forwarding, relaying and conversion explanations. Header analysis can support a conclusion about a message's handling; it rarely establishes the identity or intention of the person at the keyboard by itself.
Sources & further reading
Primary references support the technical explanation. They do not establish D3 validation of a particular method.