A forensic examiner is investigating a case involving a suspect who used Outlook Web App (OWA) to access their email. The suspect's computer has no Outlook client installed, but the browser cache contains fragments of email content. Which approach would be most effective to reconstruct the emails the suspect viewed?

Analyze the browser cache and temporary internet files for HTML and JSON fragments of the OWA interface.

Contact the email provider to obtain server logs.

Search the hard drive for .ost or .pst files.

Use a memory forensics tool to dump the RAM and search for email strings.

You are examining a Mac computer that uses Apple Mail. The user has deleted an email from the Trash folder. Where might you find remnants of this email?

In the Mail folder inside the user's Library directory.

In the Thunderbird profile folder.

An organization uses Gmail for business. A user's account is suspected of sending confidential data. The organization needs to preserve the user's emails for legal hold. Which action should be taken FIRST to ensure the data is preserved?

Suspend the user's account immediately.

Export the user's mailbox to PST using Google Takeout.

Place a legal hold on the user's account using Google Vault.

Change the user's password to prevent further access.

GIAC Certified Forensic Examiner

Domain 6Objective 3

Email Analysis GCFE Practice Questions (Page 8)

Part of the User and Cloud Artifacts domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

8concepts

Questions 36–40

36expert · hard
A forensic examiner is investigating a case involving a suspect who used Outlook Web App (OWA) to access their email. The suspect's computer has no Outlook client installed, but the browser cache contains fragments of email content. Which approach would be most effective to reconstruct the emails the suspect viewed?
Select an answer first
37foundation · easy
Which email header field contains the date and time when the message was composed by the sender's mail client?
Select an answer first
38application · medium
You are examining a Mac computer that uses Apple Mail. The user has deleted an email from the Trash folder. Where might you find remnants of this email?
Select an answer first
39expert · hard
An organization uses Gmail for business. A user's account is suspected of sending confidential data. The organization needs to preserve the user's emails for legal hold. Which action should be taken FIRST to ensure the data is preserved?
Select an answer first
40foundation · easy
Which forensic technique is used to recover deleted email fragments from unallocated space on a hard drive?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCFE” is a trademark of its owner, used for identification only.

Email Analysis GCFE Practice Questions (Page 8)

Questions 36–40

Which email header field contains the date and time when the message was composed by the sender's mail client?

You are examining a Mac computer that uses Apple Mail. The user has deleted an email from the Trash folder. Where might you find remnants of this email?

An organization uses Gmail for business. A user's account is suspected of sending confidential data. The organization needs to preserve the user's emails for legal hold. Which action should be taken FIRST to ensure the data is preserved?

Which forensic technique is used to recover deleted email fragments from unallocated space on a hard drive?

Keep studying — User and Cloud Artifacts