Investigating Email Crimes ECSS Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An investigator has collected a mailbox file (.pst) from a suspect's computer. To preserve the evidence, what should the investigator do FIRST?

   • ARename the .pst file to .bak and store it in a safe.
   • BCopy the .pst file to a USB drive and verify the copy opens in Outlook.
   • CCreate a bit-for-bit copy of the entire hard drive, then work on the copy.
   • DOpen the .pst file and export all emails to a new .pst file.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which piece of information in an email header is most useful for tracing the email back to its originating IP address?

   • AThe first 'Received' header
   • BThe 'Subject' header
   • CThe last 'Received' header
   • DThe 'Date' header
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When analyzing an email attachment, what is the first step an investigator should take to ensure safety?

   • AScan the attachment with antivirus software
   • BDelete the attachment
   • COpen the attachment to view its content
   • DForward the attachment to another email address
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An investigator is writing a report on an email fraud case. The report will be reviewed by a non-technical jury. What is the best way to present the technical findings?

   • AUse complex charts and graphs to impress the jury.
   • BInclude raw header data and technical jargon to show thoroughness.
   • CUse plain language and visual aids, such as diagrams of the email path, to explain the findings.
   • DSummarize only the conclusion without supporting details.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An investigator has completed an email crime investigation and is preparing the final report. The report will be submitted to the legal department for potential prosecution. Which of the following is the most appropriate way to present the findings?

   • AInclude a clear summary of the findings, the evidence collected, and the methods used.
   • BInclude the investigator's personal opinion about the suspect's guilt.
   • CUse technical jargon to demonstrate the investigator's expertise.
   • DProvide only the final conclusion without supporting details.
   Reveal Solution Discussion Select an answer first