EnCE Email Forensics 3

Question 1

What is email spoofing, and which header is most commonly forged to achieve it?

Accepted Answer

Falsifying the sender identity; the 'From:' header

Answer

Email spoofing involves forging the 'From:' header to make the message appear to originate from a different, often trusted sender.

Question 2

Which protocol does Thunderbird use by default to store locally downloaded email messages?

Accepted Answer

MBOX format

Answer

Mozilla Thunderbird stores email in MBOX format, which concatenates multiple messages into a single plain-text file.

Question 3

During an EnCase investigation, you find an OST file. What does this indicate about the user's email setup?

Accepted Answer

Outlook was configured in Cached Exchange Mode connected to an Exchange server

Answer

An OST (Offline Storage Table) file is created when Outlook is configured in Cached Exchange Mode, storing a local synchronized copy of the Exchange mailbox.

Question 4

Which SPF record result indicates that a sending IP is explicitly not authorized to send email for a domain?

Accepted Answer

Fail

Answer

An SPF 'Fail' result means the sending IP is explicitly listed as unauthorized to send email for that domain, often used to reject or flag the message.

Question 5

What type of evidence can be recovered from an email server's MTA logs during a forensic investigation?

Accepted Answer

Message delivery times, sender/recipient addresses, and IP addresses

Answer

Mail Transfer Agent (MTA) logs record metadata such as timestamps, sender and recipient addresses, message IDs, and the IP addresses of connecting clients.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Email Forensics 3