EnCE Email Forensics 4 — Questions and Answers
Question 1: Which EnCase feature is used to parse and display the internal structure of a PST or OST file for email review?
- File Extents viewer
- Email Examiner module / Email Parser (Correct answer)
- Disk geometry viewer
- Windows Registry viewer
Correct answer: Email Examiner module / Email Parser
EnCase's Email Examiner (or Email Parser module) can parse PST/OST files and present individual messages, attachments, and folder structures in a readable format.
Question 2: What is the purpose of analyzing email 'threading' in a forensic investigation?
- To determine the file size of each email attachment
- To reconstruct conversation sequences and establish timelines between parties (Correct answer)
- To identify the mail server software version
- To extract embedded macros from email bodies
Correct answer: To reconstruct conversation sequences and establish timelines between parties
Email threading reconstructs chronological conversations by linking messages via In-Reply-To and References headers, helping establish communication timelines.
Question 3: Which field in an email header uniquely identifies a specific message across all mail servers globally?
- Subject:
- Message-ID: (Correct answer)
- Content-Type:
- Date:
Correct answer: Message-ID:
The Message-ID header contains a globally unique identifier assigned by the originating mail server, used for threading and deduplication.
Question 4: During an investigation, an examiner finds a .eml file. Which email client natively uses this format?
- Microsoft Outlook (primary format)
- Multiple clients including Outlook Express, Windows Mail, and Thunderbird (Correct answer)
- Only Lotus Notes
- Only Apple Mail
Correct answer: Multiple clients including Outlook Express, Windows Mail, and Thunderbird
The .eml format (RFC 822) is a standard single-message format supported by many email clients including Outlook Express, Windows Mail, Thunderbird, and Apple Mail.
Question 5: What is the forensic significance of the 'Bcc:' (Blind Carbon Copy) field?
- It is always visible in recovered email headers
- BCC recipients are hidden from other recipients but may appear in the sender's sent copy or server logs (Correct answer)
- BCC prevents the email from being logged by mail servers
- BCC fields are encrypted by default in all email protocols
Correct answer: BCC recipients are hidden from other recipients but may appear in the sender's sent copy or server logs
BCC recipients are stripped from the message headers before delivery, but the sender's sent folder copy and server logs may retain the original BCC list.
Question 6: What type of steganography technique could be used to hide data within email attachments?
- Modifying the email's Date: header timestamp
- Embedding hidden data within image files attached to emails using tools like SilentEye (Correct answer)
- Changing the Reply-To address to encode binary data
- Altering the SMTP port number used for transmission
Correct answer: Embedding hidden data within image files attached to emails using tools like SilentEye
Image steganography tools can hide data within the pixel values of image files, which can then be sent as email attachments to covertly transmit information.
Question 7: Which email authentication mechanism provides a policy allowing domain owners to specify how unauthenticated mail should be handled by receivers?
- SPF
- DKIM
- DMARC (Correct answer)
- S/MIME
Correct answer: DMARC
DMARC (Domain-based Message Authentication, Reporting and Conformance) lets domain owners publish policies instructing receivers to quarantine or reject messages that fail SPF and DKIM checks.
EnCE Email Forensics 4
Which EnCase feature is used to parse and display the internal structure of a PST or OST file for email review?