What is the purpose of hashing email evidence during preservation?

To compress the evidence for storage

To verify the integrity of the evidence

To index the evidence for searching

A company has received a threatening email. The email headers show a 'Received' chain that includes a server in a foreign country, but the 'Received-SPF' header shows 'pass' for the company's own domain. The investigator suspects the email was sent through a compromised internal account. Which action is most likely to confirm this suspicion?

Look for a 'DKIM-Signature' header to verify the email's authenticity.

Examine the 'Reply-To' header to see if it matches the 'From' header.

Check the mail server logs for the IP address that authenticated to send the email.

Analyze the email's content for phishing indicators.

Which of the following is the recommended method for preserving email evidence from a local email client?

Printing the emails and storing the printouts

Creating a bit-for-bit image of the email storage file

Copying the email folder to a USB drive

What is the primary goal of the investigative process when handling an email-related offense?

To block the sender's email address permanently

To delete the offending email from the victim's mailbox

To recover the victim's password and reset it

To identify the sender and gather admissible evidence of the crime

EC-CouncilCertified Security Specialist

Domain 6Objective 6

Investigating Email Crimes ECSS Practice Questions (Page 8)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

44questions here

9free pages

8concepts

Questions 36–40

36foundation · easy
What is the purpose of hashing email evidence during preservation?
Select an answer first
37expert · hard
A company has received a threatening email. The email headers show a 'Received' chain that includes a server in a foreign country, but the 'Received-SPF' header shows 'pass' for the company's own domain. The investigator suspects the email was sent through a compromised internal account. Which action is most likely to confirm this suspicion?
Select an answer first
38foundation · easy
Which of the following is the recommended method for preserving email evidence from a local email client?
Select an answer first
39foundation · easy
What is the primary goal of the investigative process when handling an email-related offense?
Select an answer first
40foundation · easy
Which part of an email header provides the routing path of the message from the sender's mail server to the recipient's mail server?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Investigating Email Crimes ECSS Practice Questions (Page 8)

Questions 36–40

What is the purpose of hashing email evidence during preservation?

Which of the following is the recommended method for preserving email evidence from a local email client?

What is the primary goal of the investigative process when handling an email-related offense?

Which part of an email header provides the routing path of the message from the sender's mail server to the recipient's mail server?

Keep studying — Digital Forensics Investigations