An investigator has collected a mailbox image and computed its SHA-256 hash. Later, the defense attorney claims the evidence was tampered with. What is the best way to refute this claim?

Provide a screenshot of the original hash value.

Explain that the investigator used a trusted forensic tool.

Show the chain of custody log to prove no one accessed the evidence.

Recompute the hash of the original image and compare it to the hash recorded at collection time.

A company is investigating a phishing email that bypassed its email gateway. The security team has access to the email headers and the company's mail server logs. The team wants to trace the email back to the original sender's IP address. Which combination of data is most useful for this purpose?

The 'Reply-To' header and the 'Content-Type' header

The 'From' header and the 'Subject' line

The 'Received' headers and the mail server's connection logs

The 'Message-ID' and the 'Date' header

What is the primary purpose of documenting findings in an email crime investigation?

To simplify the investigation process

To advertise the investigator's skills

To create a record that can be presented in court

To replace the original evidence

EC-CouncilCertified Security Specialist

Domain 6Objective 6

Investigating Email Crimes ECSS Practice Questions (Page 9)

Part of the Digital Forensics Investigations domain, which makes up ~20% of our current practice bank.

44questions here

9free pages

8concepts

Questions 41–44

41expert · hard
An investigator has collected a mailbox image and computed its SHA-256 hash. Later, the defense attorney claims the evidence was tampered with. What is the best way to refute this claim?
Select an answer first
42application · medium
A company is investigating a phishing email that bypassed its email gateway. The security team has access to the email headers and the company's mail server logs. The team wants to trace the email back to the original sender's IP address. Which combination of data is most useful for this purpose?
Select an answer first
43foundation · easy
What is the primary purpose of documenting findings in an email crime investigation?
Select an answer first
44application · medium
An email investigator is examining a phishing email and wants to determine if the email was sent from a legitimate source or if it was spoofed. The investigator has access to the full email headers. Which header field is most useful for verifying the sender's identity?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ECSS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECSS” is a trademark of its owner, used for identification only.

Investigating Email Crimes ECSS Practice Questions (Page 9)

Questions 41–44

An investigator has collected a mailbox image and computed its SHA-256 hash. Later, the defense attorney claims the evidence was tampered with. What is the best way to refute this claim?

A company is investigating a phishing email that bypassed its email gateway. The security team has access to the email headers and the company's mail server logs. The team wants to trace the email back to the original sender's IP address. Which combination of data is most useful for this purpose?

What is the primary purpose of documenting findings in an email crime investigation?

An email investigator is examining a phishing email and wants to determine if the email was sent from a legitimate source or if it was spoofed. The investigator has access to the full email headers. Which header field is most useful for verifying the sender's identity?

Keep studying — Digital Forensics Investigations