CHFI Email and Social Media Forensics 3

Question 1

Which protocol is used to retrieve email from a mail server and keeps messages stored server-side, making it critical for cloud-based email forensics?

Accepted Answer

IMAP

Answer

IMAP (Internet Message Access Protocol) keeps emails stored on the server, meaning evidence may be preserved in the cloud even after local deletion.

Question 2

What is 'email spoofing' and what forensic technique helps identify it?

Accepted Answer

Forging the From address to impersonate another sender; identified by analyzing Received headers and DKIM/SPF results

Answer

Email spoofing forges the From header to impersonate a trusted sender; investigators identify it by tracing Received headers to the true originating IP and checking DKIM/SPF authentication failures.

Question 3

Which artifact on a Windows system stores evidence of web-based email access (e.g., Gmail via browser) useful in email forensics?

Accepted Answer

Browser cache, history, and cookies

Answer

Browser cache files may contain cached email content and attachments, browser history shows Gmail/webmail access timestamps, and cookies can reveal authenticated sessions.

Question 4

In investigating a Twitter/X account for evidence, which API does law enforcement reference for legal data requests to the platform?

Accepted Answer

Twitter's Legal Request Submission portal under the Stored Communications Act

Answer

Law enforcement submits legal requests for Twitter/X user data through Twitter's official legal request portal, following the Stored Communications Act framework for subpoenas and warrants.

Question 5

What is the purpose of analyzing the 'Bcc' (Blind Carbon Copy) field in email forensics investigations?

Accepted Answer

Bcc recipients are hidden from other recipients but may appear in server logs or sender's sent folder, revealing hidden communication parties

Answer

While Bcc recipients are invisible to To/Cc recipients, mail server logs, the sender's sent items, and mail server transaction logs may reveal who received Bcc copies.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Email and Social Media Forensics 3