Investigating Email Crimes ECSS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A forensic investigator needs to collect email evidence from a suspect's smartphone. The email app is configured with IMAP. What is the best way to preserve the evidence?

   • AOnly request the emails from the mail server because IMAP stores all emails there.
   • BForensically image the phone's storage, including the email app's data, and also request the emails from the mail server.
   • CCopy the email app's database file to a computer.
   • DTake screenshots of the emails on the phone.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of maintaining a chain of custody for email evidence?

   • ATo speed up the investigation
   • BTo encrypt the evidence
   • CTo ensure the evidence is admissible in court
   • DTo reduce the size of the evidence
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A forensic investigator must collect email evidence from a suspect's webmail account for a harassment case. The account is accessed via a browser. What is the most forensically sound approach?

   • AForward the emails to the investigator's own email account.
   • BTake screenshots of each email and save them as image files.
   • CLog into the account and print each email to PDF for the case file.
   • DUse a court order to obtain the emails directly from the service provider's servers.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is investigating an internal email leak. The suspect's mailbox is on a Microsoft Exchange server. The legal team wants to preserve evidence without disrupting business operations. What is the best approach?

   • AImmediately shut down the Exchange server and image the entire server.
   • BCopy the mailbox database file while the server is running.
   • CAsk the suspect to forward all emails to the legal team.
   • DPlace a legal hold on the mailbox and then export a copy of the mailbox to a PST file for analysis.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a common sign that an email may be spoofed?

   • AThe email has a plain-text body
   • BThe email contains a large attachment
   • CThe email was sent during business hours
   • DThe 'From' address does not match the 'Return-Path' address
   Reveal Solution Discussion Select an answer first