Investigating Email Crimes ECSS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During analysis of an email, you find that the attachment's file name is 'invoice.pdf', but the file signature (magic bytes) indicates it is a ZIP archive. What should you do?

   • AChange the file extension to .zip and then open it.
   • BDelete the attachment because it is suspicious.
   • CTreat the file as a ZIP archive and analyze its contents in a sandbox.
   • DOpen the file as a PDF because the extension says so.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An investigator has completed the analysis of an email crime and needs to document the findings for potential legal proceedings. What is the most important element to include in the documentation to ensure the evidence is admissible in court?

   • AThe investigator's personal opinion about the suspect's guilt
   • BA chain-of-custody log that records every person who handled the evidence and when
   • CA list of all software tools used during the investigation
   • DA detailed description of the email's content and attachments
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a forensically sound method for collecting email evidence from a webmail account?

   • APrinting the email and saving the printout
   • BExporting the email in .eml or .msg format with headers
   • CCopying the email text into a Word document
   • DTaking a screenshot of the email
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An investigator has collected email evidence from a suspect's computer and needs to preserve it for analysis. The investigator has created a forensic image of the hard drive. What is the next step to ensure the evidence remains unaltered?

   • AVerify the hash of the forensic image against the original drive.
   • BOpen the forensic image in an email client to view the emails.
   • CStore the forensic image on the same hard drive as the original.
   • DDelete the original drive to prevent tampering.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which technique is commonly used to forge the sender information in an email?

   • AModifying the 'From' header to a fake address
   • BAdding a digital signature
   • CUsing a secure SMTP connection
   • DEncrypting the email with PGP
   Reveal Solution Discussion Select an answer first