Which ethical principle is most important when handling email evidence that contains personal information unrelated to the investigation?

Minimizing exposure to irrelevant personal data

Publishing the data to inform the public

Sharing all data with other investigators

Deleting all emails to protect privacy

Which of the following is a forensically sound method for preserving email evidence?

Forwarding the email to a personal account for safekeeping

Creating a bit-for-bit forensic image of the storage media containing the email

Taking a screenshot of the email and saving it as a JPEG

Printing the email and storing the paper copy in a safe

During an investigation, you receive an email that allegedly contains a threat. You need to trace the true origin of the message. Which part of the email header should you examine first to identify the originating IP address?

The top-most 'Received' header, which shows the most recent relay.

The 'Return-Path' header, which contains the sender's email address.

The bottom-most 'Received' header, which shows the first hop from the sender's mail server.

The 'Message-ID' header, which uniquely identifies the message.

An investigator needs to preserve email evidence from a webmail account (e.g., Gmail) for a legal case. What is the most forensically sound method to collect the emails?

Forward the emails to the investigator's personal email account for safekeeping.

Use a forensic tool to create a logical image of the mailbox via IMAP, and document the process with hashes and timestamps.

Take screenshots of the emails and save them as PDF files.

Print the emails and have the user sign each page as a true copy.

What is the primary purpose of maintaining a chain of custody for email evidence?

To reduce the size of the evidence for storage

To make the evidence readable by any email client

To document every person who handled the evidence and ensure its integrity

To automatically delete irrelevant emails

EC-CouncilDigital Forensics Essentials

Domain 6Objective 3

Email Crime Investigation DFE Practice Questions (Page 3)

Part of the Dark Web and Email Forensics domain, which makes up ~16% of our current practice bank.

44questions here

9free pages

7concepts

Questions 11–15

11foundation · easy
Which ethical principle is most important when handling email evidence that contains personal information unrelated to the investigation?
Select an answer first
12foundation · easy
Which of the following is a forensically sound method for preserving email evidence?
Select an answer first
13application · medium
During an investigation, you receive an email that allegedly contains a threat. You need to trace the true origin of the message. Which part of the email header should you examine first to identify the originating IP address?
Select an answer first
14application · medium
An investigator needs to preserve email evidence from a webmail account (e.g., Gmail) for a legal case. What is the most forensically sound method to collect the emails?
Select an answer first
15foundation · easy
What is the primary purpose of maintaining a chain of custody for email evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.