Email is one of the media tools to communicate and can be a crime tool for profit. Fraud using email has done a lot of harm to society by sending email messages that are not known who sent the email. One of the emails that is often used for fraud is Gmail, this server is widely used by the public to commit fraudulent crimes in the form of chat transactions in which in the form of text, images, videos to commit fraud by hijacking a company's name or someone's name. The purpose of this study is to find the contents of messages sent using e-mails and find original e-mails to obtain digital evidence to be used as evidence of crime in accordance with the concept of digital fraud proof analysis using e-mail. In this study, electronic evidence in the form of the perpetrator's laptop and the victim's laptop. The victim acts as the recipient of an email message that is harmed by the perpetrator. The data source in this study comes from simulations and scenarios that have been made, this study uses 2 laptops namely Asus and Lenovo laptops. Analysis of the data in this study uses the NIST (National Institute of Technology Standards) method which has research steps in the collection, examination, analysis, and reporting. Data objects taken in the form of message content in Gmail in which in the form of chat transactions, images, videos, and proof of transfer. Search for evidence of fraud with Gmail using FTK Imager and to find the original email address using myipaddres, Iptrackeronline, Ipgeolocation, and Grabify. The results obtained in the form of proof of e-mail messages deleted by the perpetrators include proof of chat, images with the extension of jpg and video with the extension of mp4.