diff --git a/NIST_Data_Leakage_Case/NIST_Data_Leakage_03_WebHistory_SQL_Python.pptx b/NIST_Data_Leakage_Case/NIST_Data_Leakage_03_WebHistory_SQL_Python.pptx
index 1fb56e7..337c09f 100644
Binary files a/NIST_Data_Leakage_Case/NIST_Data_Leakage_03_WebHistory_SQL_Python.pptx and b/NIST_Data_Leakage_Case/NIST_Data_Leakage_03_WebHistory_SQL_Python.pptx differ
diff --git a/NIST_Data_Leakage_Case/NIST_Data_Leakage_04_Email_USB.pptx b/NIST_Data_Leakage_Case/NIST_Data_Leakage_04_Email_USB.pptx
index 9b2563b..ed95458 100644
Binary files a/NIST_Data_Leakage_Case/NIST_Data_Leakage_04_Email_USB.pptx and b/NIST_Data_Leakage_Case/NIST_Data_Leakage_04_Email_USB.pptx differ
diff --git a/NIST_Data_Leakage_Case/NIST_Data_Leakage_04_Email_USB_Python.pptx b/NIST_Data_Leakage_Case/NIST_Data_Leakage_04_Email_USB_Python.pptx
new file mode 100644
index 0000000..c55298d
Binary files /dev/null and b/NIST_Data_Leakage_Case/NIST_Data_Leakage_04_Email_USB_Python.pptx differ
diff --git a/README.md b/README.md
index 552818f..9ac8340 100644
--- a/README.md
+++ b/README.md
@@ -137,7 +137,7 @@ The [case study](https://github.com/frankwxu/digital-forensics-lab/tree/main/NIS
 | Lab 1  | [Windows Registry](NIST_Data_Leakage_Case/NIST_Data_Leakage_01_Registry.pptx)                                                |                                                                                          |
 | Lab 2  | [Windows Event and XML](NIST_Data_Leakage_Case/NIST_Data_Leakage_02._WinEvt_XML.pptx)                                        | [Python version](NIST_Data_Leakage_Case/NIST_Data_Leakage_02._WinEvt_XML_Python.pptx)    |
 | Lab 3  | [Web History and SQL](NIST_Data_Leakage_Case/NIST_Data_Leakage_03_WebHistory_SQL.pptx)                                       | [Python version](NIST_Data_Leakage_Case/NIST_Data_Leakage_03_WebHistory_SQL_Python.pptx) |
-| Lab 4  | [Email Investigation](NIST_Data_Leakage_Case/NIST_Data_Leakage_04_Email_USB.pptx)                                            |                                                                                          |
+| Lab 4  | [Email Investigation](NIST_Data_Leakage_Case/NIST_Data_Leakage_04_Email_USB.pptx)                                            | [Python version](NIST_Data_Leakage_Case/NIST_Data_Leakage_04_Email_USB_Python.pptx)      |
 | Lab 5  | [File Change History and USN Journal](NIST_Data_Leakage_Case/NIST_Data_Leakage_05_USNJournaling.pptx)                        |                                                                                          |
 | Lab 6  | [Network Evidence and shellbag](NIST_Data_Leakage_Case/NIST_Data_Leakage_06_Network_Shellbag_Jumplist.pptx)                  |                                                                                          |
 | Lab 7  | [Network Drive and Cloud](NIST_Data_Leakage_Case/NIST_Data_Leakage_07_NetworkDrive_Cloud.pptx)                               |                                                                                          |