CHFI Email and Social Media Forensics 2

Question 1

In which location does Microsoft Outlook store emails, contacts, and calendar data in a local file format?

Accepted Answer

.pst or .ost file

Answer

Outlook stores local email data in Personal Storage Table (.pst) files for local storage and Offline Storage Table (.ost) files for cached Exchange mailbox data.

Question 2

Which forensic tool is widely used to parse and examine Outlook PST files during email investigations?

Accepted Answer

Kernel OST/PST Viewer or FTK with PST support

Answer

Tools like Kernel OST/PST Viewer and FTK's email module can parse PST/OST files to recover emails, deleted items, and metadata without requiring Outlook to be installed.

Question 3

What does the 'Date' field in an email header represent, and why must investigators treat it with caution?

Accepted Answer

The date set by the sender's email client, which can be manipulated by the sender

Answer

The Date header is set by the sender's mail client and can be manually altered, so investigators should corroborate it against 'Received' header timestamps from mail servers.

Question 4

When investigating a social media account on Facebook, which legal process in the US must law enforcement typically follow to obtain private user data from Meta?

Accepted Answer

Subpoena, court order, or search warrant depending on the data type

Answer

Under the Stored Communications Act (SCA), law enforcement must use a subpoena for basic subscriber info, a court order for non-content records, and a search warrant for private message content.

Question 5

What type of data can be recovered from a Facebook account's 'Download Your Information' feature that is useful in forensic investigations?

Accepted Answer

Messages, posts, friends list, login activity, and location history

Answer

Facebook's Download Your Information feature exports a comprehensive archive including private messages, post history, friend connections, IP-based login activity, and location data.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Email and Social Media Forensics 2