Investigating Email Crimes ECSS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An investigator is analyzing an email that contains an attachment with a suspicious macro. The investigator needs to extract the macro code for analysis without executing it. Which method is the most appropriate?

   • ARename the attachment to .txt and open it in a text editor.
   • BOpen the attachment in a word processor and enable macros to see what they do.
   • CRun the attachment in a virtual machine to observe its behavior.
   • DUse a macro analysis tool to extract and disassemble the macro code.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An investigator is collecting email evidence from a suspect's computer. The computer is running and the email client is open. What is the first step the investigator should take to preserve the evidence?

   • AImmediately shut down the computer to preserve the hard drive.
   • BTake a screenshot of the open email client and then shut down the computer.
   • CClose the email client to prevent new emails from arriving.
   • DPerform a live acquisition of the computer's memory and then shut down the computer.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are collecting email evidence from an employee's Outlook mailbox. The employee is under investigation for leaking confidential data. What is the best way to preserve the mailbox?

   • AUse a forensic tool to create an image of the mailbox file while the computer is off.
   • BCopy the .pst file to a network share while Outlook is running.
   • CPrint all emails to PDF and save them to a CD.
   • DAsk the employee to export the mailbox to a new .pst file.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When tracing an email, which server logs are most valuable for correlating the message with a specific user or session?

   • ASMTP server logs
   • BDHCP server logs
   • CWeb server logs
   • DDNS server logs
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An investigator has collected a suspect email as an .eml file from a user's computer. The investigator needs to ensure the evidence is preserved and can be verified later. Which action is the most appropriate for preserving the integrity of the email evidence?

   • ACopy the .eml file to a USB drive and store it in a safe.
   • BOpen the .eml file in a text editor and save it as a .txt file.
   • CPrint the email and store the printout in an evidence bag.
   • DCalculate a SHA-256 hash of the .eml file and record it in the chain-of-custody documentation.
   Reveal Solution Discussion Select an answer first