Forensics Module 7

False

AXIOM supports searching of only traditional email client artifacts (such as POP and IMAP protocols) but not web-based email (such as Gmail).

False

All recovered emails have full header information information available, including the origin IP address for the email.

C

As emails travel from origin to destination, they go through a number of servers. Where can you locate information on the servers that an email has traveled through? A. Email body B. Email attachments C. Email headers D. Email HTML

A

How can you view an email attachment in AXIOM? A. By clicking on the hyperlink in the PREVIEW pane. B. The PREVIEW pane will render all attachments making them viewable. C. By switching to Documents view. D. Attachments are not visible in AXIOM.

False

Since emails are parsed from a database, it is not possible to view emails in File System view, only Artifact view.

False

The PREVIEW card in the Details pane will render all emails that are in HTML format.

False

When conducting a keyword search against emails, the only thing that is searched is the body of the email. Other information, such as To, From, and Subject are not searched.

B

Which of the following pieces of information would NOT be contained in an email header? A. IP address of the sender B. Password for the email client C. Email address of the sender D. Email address of the recipient

A,B,C,D

Which of the following will AXIOM parse from Microsoft Outlook? (check all that apply) A. Emails B. Contacts C. Appointments D. Notes

B

Which option would you use to export email messages from AXIOM? A. Save artifact to B. Create report / export C. Change encoding D. View connections