forensics-chapter 12

Which of the following types of files can provide useful information when you're examining an e-mail server?

.log files

In Microsoft Outlook, what are the e-mail storage files typically found on a client computer?

.pst and .ost

What information is not in an e-mail header? (Choose all that apply.)A) Blind copy (Bcc) addresses B) Internet addresses C) Domain name D) Contents of the message E) Type of e-mail server used to send the message

A) Blind copy (Bcc) addresses D) Contents of the message

When searching a victim's computer for a crime committed with a specific e-mail, which of the following provides information for determining the e-mail's originator? (Choose all that apply.) A) E-mail header B) Username and password C) Firewall log D) All of the above

A) E-mail header C) Firewall log

E-mail headers contain which of the following information? (Choose all that apply.) A)The sender and receiver e-mail addresses B)An Enhanced Simple Mail Transport Protocol (ESMTP) or reference number C)The e-mail servers the message traveled through to reach its destination D)The IP address of the receiving server E)All of the above

A)The sender and receiver e-mail addresses B)An Enhanced Simple Mail Transport Protocol (ESMTP) or reference number C)The e-mail servers the message traveled through to reach its destination

To trace an IP address in an e-mail header, what type of lookup service can you use? (Choose all that apply.) A) AT&T AnyWho online directory B) Verizon's superpages.com C) A domain lookup service, such as www.arin.net, www.internic.com, or www.whois.net D) Any Web search engine

C) A domain lookup service, such as www.arin.net, www.internic.com, or www.whois.net D) Any Web search engine

When you access your e-mail, what type of computer architecture are you using?

Client/server

Logging options on many e-mail servers can be: A) Disabled by the administrator B) Set up in a circular logging configuration C) Configured to a specific size before overwritten D) All of the above

D) All of the above

UNIX, NetWare, and Microsoft e-mail servers create specialized databases for every e-mail user. True or False?

False

Which of the following is a current formatting standard for e-mail?

MIME

What's the main piece of information you look for in an e-mail message you're investigating?

Originating e-mail domain or IP address

When confronted with an e-mail server that no longer contains a log with the date information you require for your investigation, and the client has deleted the e-mail, what should you do?

Restore the e-mail server from a backup.

In UNIX e-mail, the syslog.conf file contains what information?

The event, the priority level of concern, and the action taken when an e-mail is logged

Router logs can be use for validating what types of e-mail data?

Tracking flows through e-mail server ports

All e-mail headers contain the same types of information. True or False?

True

Internet e-mail accessed with a Web browser leaves files in temporary folders. True or False?

True

You can view e-mail headers in all popular e-mail clients. True or False?

True