If you receive a threatening or potentially criminal email, there are a few steps you can take to gather and preserve vital information that will help law enforcement investigate the origin of the email.
The first step, and possibly the most obvious, is to NOT delete the email. If this is an incident that you are going to pursue criminal charges against, preserve the email itself until advised by law enforcement on how to proceed.
Second, most emails show the account information of the sender in the “From:” field of the email header. While this information can be faked, it often provides law enforcement a credible investigative lead. If you recognize the sender address, make note of it for law enforcement.
Third, typically the best investigative lead is the full, unmodified extended headers associated will all emails. This full header information is typically hidden from standard viewing, but contains technical information that may greatly assist law enforcement in determining the true origin of the email. Each type of email program (Microsoft Outlook, Apple Mail, Gmail, GMX etc.) hides this information differently. If possible, locate and make a copy of any relevant extended headers. Find out how to retrieve full headers
SpamCop.net - SpamCop FAQ: How do I get my email program to reveal the full, unmodified email?)
When filing a complaint, remember it is important to provide detailed and concise information. The FDLE Cybercrime Office provides investigative and technical assistance to federal, state and local law enforcement officials.