Email Crime Investigation DFE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A forensic examiner needs to recover deleted emails from a Microsoft Exchange server as part of an investigation. The emails were deleted by the user and have already been purged from the 'Deleted Items' folder. What is the most appropriate next step?

   • AUse a forensic tool that can parse the Exchange database (EDB) files to recover deleted items.
   • BContact the email service provider to request a backup of the mailbox.
   • CAsk the user to check their 'Recoverable Items' folder in Outlook.
   • DCheck the user's local Outlook cache (.ost) file for the deleted emails.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An HR manager suspects an employee is using their corporate email to leak confidential data. The manager asks you, the IT security analyst, to 'just take a quick look' at the employee's mailbox to confirm the suspicion before involving legal. What should you do?

   • AAccess the mailbox immediately to prevent further data loss, then document what you found.
   • BMake a copy of the mailbox to a USB drive and give it to HR for their review.
   • CRefuse to access the mailbox until authorized by legal or HR policy, then follow the organization's incident response and evidence collection procedures.
   • DAsk the employee for their password so you can log in and check their sent items.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A user reports receiving a threatening email that appears to come from the CEO's address. You examine the full headers and see that the 'Return-Path' domain is 'example.net' while the 'From' header shows '@company.com'. The 'Received' chain shows the message entered the company's mail server from an IP address in a foreign country. What is the most reliable conclusion from these header observations?

   • AThe email is legitimate because the From header shows the CEO's address.
   • BThe email originated from the foreign IP address, so the sender is located in that country.
   • CThe email is likely spoofed, but you must trace the Received chain and verify authentication results before concluding the true source.
   • DThe email was spoofed because the Return-Path and From domains do not match.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary function of an email forensic tool when examining a suspect's email database?

   • ATo send test emails to verify the suspect's account is active
   • BTo encrypt the database to protect it from unauthorized access
   • CTo parse the database structure and extract email messages, attachments, and metadata
   • DTo compress the database to save storage space
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which part of an email header is most useful for identifying the IP address of the originating mail server?

   • AThe 'MIME-Version' header
   • BThe top-most 'Received' header
   • CThe 'Subject' header
   • DThe bottom-most 'Received' header
   Reveal Solution Discussion Select an answer first