EnCE Email Forensics 4

Question 1

Which EnCase feature is used to parse and display the internal structure of a PST or OST file for email review?

Accepted Answer

Email Examiner module / Email Parser

Answer

EnCase's Email Examiner (or Email Parser module) can parse PST/OST files and present individual messages, attachments, and folder structures in a readable format.

Question 2

What is the purpose of analyzing email 'threading' in a forensic investigation?

Accepted Answer

To reconstruct conversation sequences and establish timelines between parties

Answer

Email threading reconstructs chronological conversations by linking messages via In-Reply-To and References headers, helping establish communication timelines.

Question 3

Which field in an email header uniquely identifies a specific message across all mail servers globally?

Accepted Answer

Message-ID:

Answer

The Message-ID header contains a globally unique identifier assigned by the originating mail server, used for threading and deduplication.

Question 4

During an investigation, an examiner finds a .eml file. Which email client natively uses this format?

Accepted Answer

Multiple clients including Outlook Express, Windows Mail, and Thunderbird

Answer

The .eml format (RFC 822) is a standard single-message format supported by many email clients including Outlook Express, Windows Mail, Thunderbird, and Apple Mail.

Question 5

What is the forensic significance of the 'Bcc:' (Blind Carbon Copy) field?

Accepted Answer

BCC recipients are hidden from other recipients but may appear in the sender's sent copy or server logs

Answer

BCC recipients are stripped from the message headers before delivery, but the sender's sent folder copy and server logs may retain the original BCC list.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Email Forensics 4