Digital Forensics CH.11

17. You can view e-mail headers in Notepad with all popular e-mail clients. True or False?

False

20. A forensic linguist can determine an author's gender by analyzing chat logs and social media communications. True or False?

False

15. E-mail accessed with a Web browser leaves files in temporary folders. True or False?

True

18. To analyze e-mail evidence, an investigator must be knowledgeable about an e-mail server's internal operations. True or False?

True

7. After examining e-mail headers to find an e-mail's originating address, investigators use forward lookups to track an e-mail to a suspect. True or False?

True

3. In Microsoft Outlook, e-mails are typically stored in which of the following?

a. .pst and .ost files

13. What information is not in an e-mail header? (Choose all that apply.)

a. Blind copy (bcc) addresses d. Contents of the message

4. When searching a victim's computer for a crime committed with a specific e-mail, which of the following provides information for determining the e-mail's originator? (Choose all that apply.)

a. E-mail header c. Firewall log

19. Sendmail uses which file for instructions on processing an e-mail message?

a. Sendmail.cf

1. E-mail headers contain which of the following information? (Choose all that apply.)

a. The sender and receiver e-mail addresses b. An ESMTP number or reference number c. The e-mail servers the message traveled through to reach its destination

5. Phishing does which of the following?

b. Lures users with false promises

6. Which of the following is a current formatting standard for e-mail?

b. MIME

2. What's the main piece of information you look for in an e-mail message you're investigating?

b. Originating e-mail domain or IP address

16. When confronted with an e-mail server that no longer contains a log with the date information you require for your investigation, and the client has deleted the e-mail, what should you do?

b. Restore the e-mail server from a backup.

11. Logging options on e-mail servers can be which of the following? (Choose all that apply.)

b. Set up in a circular logging configuration c. Configured to a specified size before being overwritten

14. Which of the following types of files can provide useful information when you're examining an e-mail server?

c. .log files

9. To trace an IP address in an e-mail header, what type of lookup service can you use? (Choose all that apply.)

c. A domain lookup service, such as www.arin.net, www.internic.com, or www.whois.net d. Any Web search engine

8. When you access your e-mail, what type of computer architecture are you using?

c. Client/server

10. Router logs can be use for validating what types of e-mail data?

c. Tracking flows through e-mail server ports

12. On a UNIX-like system, which file specifies where to save different types of e-mail log files?

c. syslog.conf