Email and Social Media Forensics CHFI Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company's mail server logs show that a large number of emails were sent from an internal user's account to external addresses at 3:00 AM. The user claims they did not send these emails. The 'Received' headers in the emails show the messages originated from the company's mail server, but the 'Authentication-Results' headers show 'spf=pass' and 'dkim=pass'. Which of the following is the most likely explanation?

   • AThe emails were spoofed by an external attacker who forged the Received headers to appear as if they came from the company's server.
   • BThe mail server was misconfigured, causing it to send emails automatically.
   • CThe user's account was compromised, and the attacker used the user's credentials to send emails through the company's server.
   • DThe user's computer was infected with malware that sent emails using the user's Outlook client.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A forensic examiner is analyzing a smartphone that was used to post a threatening message on a social media platform. The phone is an iPhone with iOS 16. The suspect used the platform's native app. The examiner needs to recover the message content and associated metadata. Which approach is most effective?

   • AOnly analyze the device's backup files in iCloud.
   • BPerform a full filesystem acquisition and analyze the app's container directories, including databases and caches.
   • CCheck the device's notification history for the message content.
   • DUse the social media platform's API to retrieve the message.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which social media platform's forensic analysis often involves examining the 'archive' feature that allows users to download their data, including tweets and direct messages?

   • ASnapchat
   • BInstagram
   • CTwitter
   • DFacebook
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   As a forensic analyst, you are reviewing mail server logs to reconstruct a phishing campaign that targeted your organization. You notice that many messages were sent from internal user accounts to external addresses at unusual hours, and the 'Received' headers in the messages do not match the server logs. What does this discrepancy most likely indicate?

   • AThe mail server logs are incomplete due to normal log rotation.
   • BThe messages were sent through an unauthorized relay or the headers were forged to hide the true path.
   • CThe emails were sent from a different mail server that is not in the logs.
   • DThe internal user accounts were compromised and are sending legitimate emails.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic investigator needs to recover evidence of webmail usage from a suspect's computer. The suspect used Firefox to access Gmail and Outlook.com. Which of the following locations should the investigator prioritize for recovering webmail content?

   • AThe system's pagefile.sys, which contains complete copies of all webmail messages.
   • BThe Outlook PST file, because webmail is synchronized to the desktop client.
   • CThe Windows Registry, which stores the full text of all webmail messages.
   • DThe Firefox profile folder, including places.sqlite, cache2, and cookies.sqlite.
   Reveal Solution Discussion Select an answer first