forensics-chapter 12
Which of the following types of files can provide useful information when you're examining an e-mail server?
.log files
In Microsoft Outlook, what are the e-mail storage files typically found on a client computer?
.pst and .ost
What information is not in an e-mail header? (Choose all that apply.)A) Blind copy (Bcc) addresses B) Internet addresses C) Domain name D) Contents of the message E) Type of e-mail server used to send the message
A) Blind copy (Bcc) addresses D) Contents of the message
When searching a victim's computer for a crime committed with a specific e-mail, which of the following provides information for determining the e-mail's originator? (Choose all that apply.) A) E-mail header B) Username and password C) Firewall log D) All of the above
A) E-mail header C) Firewall log
E-mail headers contain which of the following information? (Choose all that apply.) A)The sender and receiver e-mail addresses B)An Enhanced Simple Mail Transport Protocol (ESMTP) or reference number C)The e-mail servers the message traveled through to reach its destination D)The IP address of the receiving server E)All of the above
A)The sender and receiver e-mail addresses B)An Enhanced Simple Mail Transport Protocol (ESMTP) or reference number C)The e-mail servers the message traveled through to reach its destination
To trace an IP address in an e-mail header, what type of lookup service can you use? (Choose all that apply.) A) AT&T AnyWho online directory B) Verizon's superpages.com C) A domain lookup service, such as www.arin.net, www.internic.com, or www.whois.net D) Any Web search engine
C) A domain lookup service, such as www.arin.net, www.internic.com, or www.whois.net D) Any Web search engine
When you access your e-mail, what type of computer architecture are you using?
Client/server
Logging options on many e-mail servers can be: A) Disabled by the administrator B) Set up in a circular logging configuration C) Configured to a specific size before overwritten D) All of the above
D) All of the above
UNIX, NetWare, and Microsoft e-mail servers create specialized databases for every e-mail user. True or False?
False
Which of the following is a current formatting standard for e-mail?
MIME
What's the main piece of information you look for in an e-mail message you're investigating?
Originating e-mail domain or IP address
When confronted with an e-mail server that no longer contains a log with the date information you require for your investigation, and the client has deleted the e-mail, what should you do?
Restore the e-mail server from a backup.
In UNIX e-mail, the syslog.conf file contains what information?
The event, the priority level of concern, and the action taken when an e-mail is logged
Router logs can be use for validating what types of e-mail data?
Tracking flows through e-mail server ports
All e-mail headers contain the same types of information. True or False?
True
Internet e-mail accessed with a Web browser leaves files in temporary folders. True or False?
True
You can view e-mail headers in all popular e-mail clients. True or False?
True
