Email and Social Media Forensics CHFI Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   You are investigating a case involving a suspect who uses Facebook, Twitter, and Instagram on their iPhone. You have legal authority to examine the device. Which of the following is the most appropriate forensic approach to recover social media artifacts from these apps?

   • APerform a full file system extraction and parse the app sandbox directories for each social media app.
   • BPerform a logical extraction that only includes photos and contacts.
   • CUse a cloud backup of the iPhone to retrieve all social media data.
   • DManually open each app and take screenshots of the user's profiles.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A forensic examiner is investigating a case where a suspect used both Outlook desktop client and webmail (Outlook on the web) on the same Windows computer. The suspect's Outlook profile is configured with a cached Exchange mode, and the browser is Chrome. The examiner needs to recover deleted emails that were sent via webmail. Which of the following is the most effective approach?

   • AUse a forensic tool to carve deleted files from the unallocated space of the hard drive, which will recover the full emails.
   • BExamine the Chrome cache and history for fragments of webmail pages, and also check the Exchange server logs for sent items.
   • CCheck the Windows Event Logs, which record all webmail activity.
   • DRecover the OST file and use a tool to parse deleted items, which may contain emails sent via webmail.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In email tracing, which header field is most commonly used to identify the originating IP address of the sender?

   • AReceived
   • BContent-Type
   • CDate
   • DTo
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A forensic examiner is investigating a suspect's Windows 10 computer. The suspect used Microsoft Outlook (desktop client) to access a corporate Exchange account, and also used webmail (Outlook on the web) in Chrome. Which of the following is the most comprehensive approach to recover email artifacts from both clients?

   • AExamine the Outlook PST/OST file and also parse Chrome's cache, history, and Cookies files for webmail data.
   • BUse a single tool that automatically extracts all email data from the hard drive without needing to know the client.
   • CExamine only the Chrome cache and history because Outlook data is stored on the server.
   • DOnly examine the Outlook PST/OST file for cached emails and contacts.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A private investigator is tasked with building a digital footprint of a person of interest using publicly available social media information. The investigator needs to document evidence that will be admissible in court. Which of the following actions is most appropriate for legally and ethically collecting this information?

   • ACreate a fake account to friend the person and access private posts.
   • BAsk the person's friends to share their private posts and messages.
   • CManually browse the person's public profiles and take screenshots, recording the URL, date, and time of capture.
   • DUse a third-party tool to scrape all data from the person's profiles, including private messages.
   Reveal Solution Discussion Select an answer first