Computer Forensics Ch. 11

Which of the following types of files can provide useful information when you're examin-ing an e-mail server?

.log files

In Microsoft Outlook, what are the e-mail storage files typically found on a client computer?

.pst and .ost

To trace an IP address in an e-mail header, what type of lookup service can you use?

A domain lookup service, such as www.arin.net, www.internic.com, or www.whois.net Any Web search engine

When you access your e-mail, what type of computer architecture are you using?

Client/server architecture

E-mail headers contain what information?

The sender and receiver e-mail addresses An ESMTP number or reference number The e-mail servers the message traveled through to reach its destination

What information is not in an e-mail header?

contents of the message

When searching a victim's computer for a crime committed with a specific e-mail, what provides information for determining the e-mail's originator?

email header and firewall log

A forensic linguist can determine an author's gender by analyzing chat logs and social media communications. True or False?

false

You can view e-mail headers in Notepad with all popular e-mail clients. True or False?

false

Phishing does which of the following?

lures with false promises

Which of the following is a current formatting standard for e-mail?

mime

What's the main piece of information you look for in an e-mail message you're investigating?

originating email domain and IP address

When confronted with an e-mail server that no longer contains a log with the date information you need for your investigation, and the client has deleted the e-mail, what should you do?

restore the e-mail server from a backup

Sendmail uses which file for instructions on processing an e-mail message?

sendmail.cf

Logging options on many e-mail servers can be:

set up in a circular logging config, configured to a specific size before overwritten

On a UNIX-like system, which file specifies where to save different types of e-mail log files?

syslog.conf

Router logs can be used to verify what types of e-mail data?

tracking traffic flowing through its ports

After examining e-mail headers to find an e-mail's originating address, investigators use forward lookups to track an e-mail to a suspect. True or False?

true

Internet e-mail accessed with a Web browser leaves files in temporary folders. True or False?

true

To analyze e-mail evidence, an investigator must be knowledgeable about an e-mail server's internal operations. True or False?

true