EnCE Email Forensics 3 — Questions and Answers
Question 1: What is email spoofing, and which header is most commonly forged to achieve it?
- Altering the MIME version; MIME-Version:
- Falsifying the sender identity; the 'From:' header (Correct answer)
- Injecting malicious links; the 'Subject:' header
- Duplicating messages; the 'BCC:' header
Correct answer: Falsifying the sender identity; the 'From:' header
Email spoofing involves forging the 'From:' header to make the message appear to originate from a different, often trusted sender.
Question 2: Which protocol does Thunderbird use by default to store locally downloaded email messages?
- PST format
- MBOX format (Correct answer)
- EDB format
- NSF format
Correct answer: MBOX format
Mozilla Thunderbird stores email in MBOX format, which concatenates multiple messages into a single plain-text file.
Question 3: During an EnCase investigation, you find an OST file. What does this indicate about the user's email setup?
- The user only accessed email via webmail
- Outlook was configured in Cached Exchange Mode connected to an Exchange server (Correct answer)
- The PST file is corrupted and converted to OST
- The user used Lotus Notes for email
Correct answer: Outlook was configured in Cached Exchange Mode connected to an Exchange server
An OST (Offline Storage Table) file is created when Outlook is configured in Cached Exchange Mode, storing a local synchronized copy of the Exchange mailbox.
Question 4: Which SPF record result indicates that a sending IP is explicitly not authorized to send email for a domain?
- Pass
- Fail (Correct answer)
- SoftFail
- Neutral
Correct answer: Fail
An SPF 'Fail' result means the sending IP is explicitly listed as unauthorized to send email for that domain, often used to reject or flag the message.
Question 5: What type of evidence can be recovered from an email server's MTA logs during a forensic investigation?
- Decrypted message content
- Message delivery times, sender/recipient addresses, and IP addresses (Correct answer)
- Attachment file hashes only
- User account passwords
Correct answer: Message delivery times, sender/recipient addresses, and IP addresses
Mail Transfer Agent (MTA) logs record metadata such as timestamps, sender and recipient addresses, message IDs, and the IP addresses of connecting clients.
Question 6: In DKIM authentication, what is being cryptographically signed?
- The sender's IP address
- Selected email headers and the message body (Correct answer)
- The recipient's domain only
- The SMTP session transcript
Correct answer: Selected email headers and the message body
DKIM signs a hash of selected email headers and the message body using a private key, allowing the receiving server to verify authenticity using the published public key.
Question 7: When examining a deleted email in an EnCase PST analysis, what does 'soft delete' mean?
- The email was permanently wiped with DoD standards
- The email is moved to the Deleted Items folder but still recoverable (Correct answer)
- The email's header was zeroed out but the body remains
- The email was archived to a separate PST
Correct answer: The email is moved to the Deleted Items folder but still recoverable
A soft delete in Outlook moves the message to the Deleted Items folder; the data is retained and fully recoverable until the folder is emptied.
EnCE Email Forensics 3
What is email spoofing, and which header is most commonly forged to achieve it?