EnCE Email Forensics 2 — Questions and Answers
Question 1: Which email header field is most useful for tracing the originating IP address of a message?
- From:
- Received: (Correct answer)
- Reply-To:
- Message-ID:
Correct answer: Received:
The 'Received:' headers form a chain of servers that handled the email and typically include IP addresses of originating hosts.
Question 2: In EnCase, which artifact type would you examine to find Outlook email data stored in a single file format?
- EML files
- PST files (Correct answer)
- MBOX files
- DBX files
Correct answer: PST files
PST (Personal Storage Table) files are used by Microsoft Outlook to store email messages, calendar items, and contacts in a single proprietary file.
Question 3: What does the SMTP 'EHLO' command indicate in email traffic analysis?
- End of message transmission
- Extended SMTP greeting identifying the sending server (Correct answer)
- Encrypted handshake for TLS
- Error handling log output
Correct answer: Extended SMTP greeting identifying the sending server
EHLO is the Extended SMTP greeting command used to identify the sending mail server and negotiate extended capabilities.
Question 4: When analyzing a suspect's webmail account activity in EnCase, which browser artifact is most relevant?
- Cookies only
- Browser history, cache, and cookies combined (Correct answer)
- Only the download folder
- Font cache files
Correct answer: Browser history, cache, and cookies combined
Webmail forensics requires examining browser history, cached page content, and cookies together to reconstruct session activity.
Question 5: Which encoding method is commonly used to represent binary attachments within a plain-text email body?
- ROT13
- Base64 (Correct answer)
- UTF-16
- Hexadecimal
Correct answer: Base64
Base64 encoding converts binary data into ASCII text characters, allowing binary attachments to be safely embedded in MIME email messages.
Question 6: In email forensics, what is the significance of the 'X-Originating-IP' header?
- It marks the email as spam
- It records the IP address of the user who sent the email (Correct answer)
- It identifies the recipient's mail server
- It logs the DNS lookup result for the domain
Correct answer: It records the IP address of the user who sent the email
The X-Originating-IP header is added by some mail providers and records the IP address of the client that submitted the email.
Question 7: Which EnCase feature allows an examiner to search for email-related keywords across unallocated space?
- File signature analysis
- Keyword search with GREP expressions (Correct answer)
- Hash library matching
- Registry viewer
Correct answer: Keyword search with GREP expressions
EnCase's keyword search with GREP expressions can scan unallocated clusters and slack space for email fragments including addresses and message content.
EnCE Email Forensics 2
Which email header field is most useful for tracing the originating IP address of a message?