CHFI Email and Social Media Forensics

Question 1

Which email header field is most important for tracing the originating IP address of an email message?

Accepted Answer

Received

Answer

The 'Received' headers form a chain of mail server hops and the earliest 'Received' header contains the originating IP address of the sender.

Question 2

In email forensics, what does the 'X-Originating-IP' header reveal?

Accepted Answer

The IP address of the client that originally submitted the email

Answer

The X-Originating-IP header, added by some mail providers, records the IP address of the device that originally sent the email, which can identify the sender's location.

Question 3

Which tool is commonly used by CHFI investigators to analyze email headers and trace email origins?

Accepted Answer

MXToolbox Email Header Analyzer

Answer

MXToolbox Email Header Analyzer parses raw email headers to display the routing path, timestamps, and originating IP addresses in an investigator-friendly format.

Question 4

What is the forensic significance of the MIME (Multipurpose Internet Mail Extensions) structure in email investigation?

Accepted Answer

It encodes attachments and multi-part content that may contain embedded malware or evidence

Answer

MIME encoding allows emails to carry attachments and multi-part content; forensic investigators must decode MIME parts to extract and examine potentially malicious or evidential attachments.

Question 5

Which email authentication mechanism adds a digital signature to outgoing emails that can be verified to confirm the sender's domain integrity?

Accepted Answer

DKIM

Answer

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the email header that allows receivers to verify the email was not altered and originated from the claimed domain.

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI - Computer Hacking Forensic Investigator Practice Test

CHFI Email and Social Media Forensics