Investigating Email Crimes ECSS Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a key element of a well-written email crime investigation report?

   • AA list of all possible suspects
   • BA detailed description of the tools and methods used
   • CA summary of the victim's email usage habits
   • DThe investigator's personal opinion about the suspect
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   In an email header, which field typically contains the email address of the sender as displayed to the recipient?

   • AReturn-Path
   • BReceived
   • CMessage-ID
   • DFrom
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An investigator is preparing a report for an email crime investigation. The report will be reviewed by a non-technical legal team. The investigator has collected email headers, server logs, and forensic images. What is the most effective way to present the technical evidence in the report?

   • AUse technical jargon to demonstrate the investigator's expertise.
   • BExclude all technical details and only provide the final conclusion.
   • CProvide a high-level summary of the findings and use diagrams to illustrate the email's path.
   • DInclude the raw email headers and server logs in the appendix.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During analysis of an email, you notice the 'Received' timestamp is 30 minutes before the 'Date' header. What does this indicate?

   • AThe email was sent from a different time zone.
   • BThe email is definitely spoofed.
   • CThe Date header may have been forged, or the clocks on the servers are not synchronized.
   • DThe email was delayed in transit.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An investigator has collected email evidence from a suspect's computer. The evidence includes an email client's mailbox file and several related files. The investigator needs to preserve the evidence in a way that allows for later analysis without altering the original. Which approach is the most forensically sound?

   • AOpen the mailbox file in the email client to view the emails.
   • BCopy the mailbox file to a network share and analyze it directly.
   • CConvert the mailbox file to a PST file for easier analysis.
   • DCreate a forensic image of the entire hard drive and analyze the image.
   Reveal Solution Discussion Select an answer first