The Internet has become open, public and widely used as a source of data transmission and exchangingmessages between criminals, terrorists and those who have illegal motivations. Moreover, it can be used forexchanging important data between various military and financial institutions, or even ordinary citizens. One ofthe important means of exchanging information widely used on the Internet medium is the e- mail. Email messagesare digital evidence that has been become one of the important means to adopt by courts in many countries andsocieties as evidence relied upon in condemnation, that prompts the researchers to work continuously to developemail analysis tool using the latest technologies to find digital evidence from email messages to assist the forensicexpertise into to analyze email groups. This work presents a distinct technique for analyzing and classifying emailsbased on data processing and extraction, trimming, and refinement, clustering, then using the SWARM algorithmto improve the performance and then adapting support vector machine algorithm to classify these emails to obtainpractical and accurate results. This framework, also proposes a hybrid English lexical Dictionary (SentiWordNet3.0) for email forensic analysis, it contains all the sentiwords such as positive and negative and can deal with theMachine Learning algorithm. The proposed system is capable of learning in an environment with large and variabledata to test the proposed system will be select available data which is Enron Data set. A high accuracy rate is 92%was obtained in best case. The experiment is conducted the Enron email dataset corpus (May 7, 2015 Version ofthe dataset).