Email Crime Investigation DFE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A multinational company is investigating a case of corporate espionage. The suspected emails are stored on servers in two different countries, one with strict data privacy laws and another with more lenient laws. The investigation team wants to collect evidence from both locations. What is the most important legal consideration?

   • ACollect the data as quickly as possible before the laws change.
   • BOnly collect data from the country with more lenient laws to simplify the process.
   • CAsk the employees to voluntarily provide their emails to avoid legal issues.
   • DComply with the data privacy laws of each country where the data resides, and obtain necessary legal authorization.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An investigator is collecting email evidence from a suspect's computer. The investigator wants to ensure the evidence is admissible in court. Which action is most important to maintain the chain of custody?

   • AMake a copy of the email files and analyze the copy, leaving the original untouched.
   • BEncrypt the evidence files to prevent unauthorized access.
   • CDocument every person who handles the evidence and every action taken with it.
   • DUse a write blocker when accessing the hard drive.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   You are collecting email evidence from a suspect's laptop. The emails are stored in an Outlook PST file. What is the best practice for preserving this evidence?

   • AOpen the PST in Outlook and print all emails.
   • BEmail the PST file to yourself as an attachment.
   • CCopy the PST file to a forensic image and hash the original and copy.
   • DRename the PST file to .bak and store it on the same drive.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A user receives an email that appears to be from a colleague, but the 'Received' header shows the message came from an external IP. The SPF check fails. What is the most likely explanation?

   • AThe colleague's email client is misconfigured.
   • BThe email was sent through a legitimate relay that is not in the SPF record.
   • CThe email was spoofed to appear from the colleague.
   • DThe email is legitimate but the SPF record is outdated.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A forensic examiner needs to analyze a large volume of emails from a corporate mail server to find evidence of fraud. The emails are stored in a proprietary format. What is the most efficient approach?

   • APrint all emails and review them on paper.
   • BUse a specialized email forensic tool that can parse the proprietary format and index the content for searching.
   • CConvert the emails to PDF and use a PDF reader to search.
   • DManually open each email in a text editor and search for keywords.
   Reveal Solution Discussion Select an answer first