Email and Social Media Forensics CHFI Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A forensic investigator is collecting evidence from a public Facebook profile for a civil litigation case. The investigator plans to use a web scraping tool to download all posts and images. Which of the following is the most important legal and ethical consideration?

   • AThe investigator must ensure the scraping tool does not alter the user's profile.
   • BThe investigator must obtain the user's consent before collecting public posts.
   • CThe investigator must comply with Facebook's terms of service, which may prohibit automated scraping.
   • DThe investigator must obtain a warrant before accessing any public profile.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An investigator is collecting evidence from a suspect's public Instagram profile for a criminal investigation. The investigator is based in one country, the suspect is in another, and the social media platform is headquartered in a third country. Which legal consideration is most important?

   • AThe investigator must ensure compliance with the data protection laws of all three countries involved.
   • BThe investigator must use a VPN to access the suspect's profile from the platform's country.
   • CThe investigator must obtain consent from the suspect before collecting public data.
   • DThe investigator must obtain a court order in the investigator's country to collect public data.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A forensic examiner is investigating a suspect's Android phone. The suspect used the Facebook app and also accessed Facebook through the Chrome browser. The examiner needs to recover deleted Facebook messages. Which of the following is the most effective approach?

   • AExtract the Facebook app's database from /data/data/com.facebook.katana and look for deleted messages in SQLite free pages.
   • BPerform a factory reset of the phone to recover deleted data.
   • CUse a logical extraction that only includes the phone's media files.
   • DExamine the Chrome cache and history for fragments of Facebook messages.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A forensic investigator is collecting evidence from a public Facebook page for a fraud investigation. The investigator plans to use the collected data in a civil court case. Which action is most consistent with legal and ethical guidelines?

   • ACreate a fake account to friend the page owner and access private posts.
   • BDownload all photos and videos from the page without noting the source.
   • CCapture screenshots of the public page and save the HTML source with timestamps and the URL.
   • DUse the Facebook Graph API to extract all data without authentication.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A forensic investigator is analyzing a suspicious email that appears to be from a bank. The email's headers show 'SPF: fail' and 'DKIM: fail', but the 'From' header displays the bank's domain. The 'Received' chain shows the email originated from a dynamic IP address in a residential range. The investigator needs to determine if the email is a phishing attempt. Which of the following is the most conclusive evidence?

   • AThe combination of SPF/DKIM failures and the residential IP address is strong evidence of phishing.
   • BThe originating IP address being in a residential range is conclusive proof of phishing.
   • CThe 'From' header displaying the bank's domain is conclusive proof that the email is from the bank.
   • DThe SPF and DKIM failures are conclusive proof of phishing.
   Reveal Solution Discussion Select an answer first