Email Analysis GCFE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   You are examining a Windows system that uses Microsoft Outlook with an Exchange account. The user has deleted several emails from the mailbox. Where should you look for remnants of these emails?

   • AIn the Outlook PST file.
   • BIn the Thunderbird profile folder.
   • CIn the Outlook OST file.
   • DIn the Windows Registry.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   You are building a timeline of a suspect's activities. You have an email that was sent from the suspect's account at 10:00 AM, and you also have a log entry showing the suspect logged into their workstation at 9:55 AM. Which additional artifact would be most useful to corroborate that the suspect actually sent the email from that workstation?

   • AThe email's Date header
   • BThe email's Received: from header
   • CThe email's X-Originating-IP header
   • DThe email's Message-ID header
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A forensic examiner is investigating a Windows 10 system that used Microsoft Outlook 2016. The user's mailbox is in Exchange Online, but the examiner needs to find locally cached email artifacts. Which of the following locations would contain the most relevant email data for offline analysis?

   • AC:\Windows\System32\config\SOFTWARE
   • BC:\Users\<user>\AppData\Local\Microsoft\Outlook\Outlook.ost
   • CC:\Users\<user>\Documents\Outlook Files\archive.pst
   • DC:\Program Files\Microsoft Office\root\Office16\Outlook.exe
   Reveal Solution Discussion Select an answer first
5. 34application · hard

   During an investigation, you need to determine the exact time a suspect received an email and when they first opened it. The email is stored in an Outlook .msg file. Which combination of metadata fields would provide the most reliable evidence for these two events?

   • AThe 'Received' header and the 'Date' header from the email headers.
   • BThe 'Sent' timestamp from the sender's email and the 'Received' timestamp from the recipient's server.
   • CThe PR_MESSAGE_DELIVERY_TIME property and the PR_LAST_VERB_EXECUTED property with its timestamp.
   • DThe file system creation time and modification time of the .msg file.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A forensic examiner is looking for email artifacts on a Linux system that used Mozilla Thunderbird. Where should the examiner look for the user's email messages and metadata?

   • AIn /var/mail/
   • BIn /etc/thunderbird/
   • CIn /opt/thunderbird/
   • DIn the user's home directory under ~/.thunderbird/
   Reveal Solution Discussion Select an answer first