Recently, email spam is noticed as a covert communication platform for criminals. Yet, discovering incriminating information from spam emails is one of the most tedious tasks due to characteristics of email spam. In this paper, we proposed a systematic content-based analysis method to discover suspicious messages in the spam folder. It is applied to the initial stage of investigation, in which investigator often have little information on the collection of spam emails. Experimental results suggest that the proposed method is able to identify potential evidence by analyzing keywords, URL links, named entities etc. Furthermore, a modified text visualization technique is employed to refine and display analysis results.