EnCE Email Forensics 2

Question 1

Which email header field is most useful for tracing the originating IP address of a message?

Accepted Answer

Received:

Answer

The 'Received:' headers form a chain of servers that handled the email and typically include IP addresses of originating hosts.

Question 2

In EnCase, which artifact type would you examine to find Outlook email data stored in a single file format?

Accepted Answer

PST files

Answer

PST (Personal Storage Table) files are used by Microsoft Outlook to store email messages, calendar items, and contacts in a single proprietary file.

Question 3

What does the SMTP 'EHLO' command indicate in email traffic analysis?

Accepted Answer

Extended SMTP greeting identifying the sending server

Answer

EHLO is the Extended SMTP greeting command used to identify the sending mail server and negotiate extended capabilities.

Question 4

When analyzing a suspect's webmail account activity in EnCase, which browser artifact is most relevant?

Accepted Answer

Browser history, cache, and cookies combined

Answer

Webmail forensics requires examining browser history, cached page content, and cookies together to reconstruct session activity.

Question 5

Which encoding method is commonly used to represent binary attachments within a plain-text email body?

Accepted Answer

Base64

Answer

Base64 encoding converts binary data into ASCII text characters, allowing binary attachments to be safely embedded in MIME email messages.

(EnCE) EnCase Certified Examiner Practice Test