A user reports receiving a phishing email that appears to come from the company's CEO. The email's Reply-To address is an external Gmail account, and the Received headers show the message originated from an IP address in a foreign country. The user wants to know if the email was truly sent by the CEO. What is the most reliable way to determine whether the email was spoofed?

Compare the SPF and DKIM authentication results in the email headers with the sending domain's published records.

Ask the CEO whether they sent the email.

Check whether the Reply-To address matches the CEO's official email address.

Trace the originating IP address using a WHOIS lookup to see if it belongs to the company.

A forensic examiner is investigating a case involving emails from a mobile device. The device uses a cloud-based email service. The examiner needs to recover deleted emails that were synced to the device. What is the most significant challenge?

Deleted emails may still exist in the cloud service's servers, but the examiner may not have legal authority to access them.

Mobile devices do not store email data, so recovery is impossible.

Cloud email services do not retain deleted emails.

The examiner must use a different tool for every cloud provider.

You are investigating a case where a suspect used a webmail service to send threatening emails. The suspect has since deleted the emails from their account. You have a court order for the email provider. What is the best approach to recover the deleted emails?

Request the account data from the provider under the court order, including deleted items and metadata.

Check the suspect's local email client for cached copies.

Use a forensic tool to analyze the suspect's browser cache and recover fragments.

Use a password reset to access the account and check the trash folder.

An investigator is tracing an email that was sent anonymously. The email headers show a chain of 'Received' headers, but the originating IP address is a public IP that belongs to a VPN provider. What is the most significant challenge in identifying the sender?

The email is impossible to trace because VPNs are illegal.

The email must have been sent from a public computer because VPNs are not used for email.

The VPN provider may not keep logs, and legal requests may be required to obtain any identifying information.

The investigator should immediately contact the VPN provider for the user's identity.

EC-CouncilDigital Forensics Essentials

Domain 6Objective 3

Email Crime Investigation DFE Practice Questions (Page 7)

Part of the Dark Web and Email Forensics domain, which makes up ~16% of our current practice bank.

44questions here

9free pages

7concepts

Questions 31–35

31application · medium
A user reports receiving a phishing email that appears to come from the company's CEO. The email's Reply-To address is an external Gmail account, and the Received headers show the message originated from an IP address in a foreign country. The user wants to know if the email was truly sent by the CEO. What is the most reliable way to determine whether the email was spoofed?
Select an answer first
32expert · hard
A forensic examiner is investigating a case involving emails from a mobile device. The device uses a cloud-based email service. The examiner needs to recover deleted emails that were synced to the device. What is the most significant challenge?
Select an answer first
33expert · hard
You are investigating a case where a suspect used a webmail service to send threatening emails. The suspect has since deleted the emails from their account. You have a court order for the email provider. What is the best approach to recover the deleted emails?
Select an answer first
34expert · hard
An investigator is tracing an email that was sent anonymously. The email headers show a chain of 'Received' headers, but the originating IP address is a public IP that belongs to a VPN provider. What is the most significant challenge in identifying the sender?
Select an answer first
35foundation · easy
Which email header field is used to trace the path an email took from the sender's mail server to the recipient's mailbox?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.

Email Crime Investigation DFE Practice Questions (Page 7)

Questions 31–35

A forensic examiner is investigating a case involving emails from a mobile device. The device uses a cloud-based email service. The examiner needs to recover deleted emails that were synced to the device. What is the most significant challenge?

You are investigating a case where a suspect used a webmail service to send threatening emails. The suspect has since deleted the emails from their account. You have a court order for the email provider. What is the best approach to recover the deleted emails?

An investigator is tracing an email that was sent anonymously. The email headers show a chain of 'Received' headers, but the originating IP address is a public IP that belongs to a VPN provider. What is the most significant challenge in identifying the sender?

Which email header field is used to trace the path an email took from the sender's mail server to the recipient's mailbox?

Keep studying — Dark Web and Email Forensics