Email and Social Media Forensics CHFI Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A forensic analyst is examining a video posted on a suspect's Instagram account. The video was downloaded from the post. The analyst wants to determine the exact location where the video was recorded. Which of the following is the most reliable method?

   • AAnalyze the video's audio for background noise to estimate the location.
   • BUse the video's file name, which often contains the location.
   • CCheck the Instagram post's location tag, which is always accurate.
   • DExamine the video's EXIF metadata for GPS coordinates.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A user is suspected of using a company computer to access a personal webmail account (e.g., Gmail) and send confidential files. The user primarily used a web browser and did not configure any email client. Which forensic approach would be most effective in recovering evidence of the webmail activity?

   • AAnalyze the browser's cache, history, and temporary internet files for webmail page artifacts.
   • BExamine the Windows Event Logs for application error entries related to the browser.
   • CCheck the user's Outlook OST file for cached messages.
   • DLook for the user's email server logs on the company's Exchange server.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   When investigating webmail usage, which browser artifact is most likely to contain fragments of email content or subject lines?

   • ABrowser cache
   • BBookmarks
   • CBrowser history
   • DCookies
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An investigator is building a profile of a suspect using social media. The suspect has a public Twitter account, a private Facebook account, and a LinkedIn account with limited visibility. The investigator needs to gather as much information as possible while staying within legal and ethical boundaries. Which approach is most appropriate?

   • ACollect data from the public Twitter and LinkedIn profiles, and only use publicly visible information from Facebook without logging in.
   • BAsk the suspect's friends to provide screenshots of private posts.
   • CUse a third-party tool that claims to bypass privacy settings and scrape private data.
   • DSend a friend request to the suspect's Facebook account using a fake profile to gain access to private posts.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A user is suspected of leaking sensitive information via email. The user uses Mozilla Thunderbird on a Linux workstation. The investigator needs to recover deleted emails and contacts. Which local artifact should be the primary focus?

   • AThe browser's cache files.
   • BThe Thunderbird profile directory containing the 'Mail' folder and 'abook.sqlite' file.
   • CThe system's syslog files.
   • DThe user's shell history file.
   Reveal Solution Discussion Select an answer first