EnCE Email Forensics 5 — Questions and Answers
Question 1: An examiner finds email messages in unallocated clusters. What forensic technique enabled this recovery?
- Registry analysis
- File carving based on email header signatures (Correct answer)
- MFT journal parsing
- Browser cache extraction
Correct answer: File carving based on email header signatures
File carving searches unallocated space for known file headers and footers (such as MIME boundaries or PST signatures) to reconstruct deleted files without relying on filesystem metadata.
Question 2: Which email protocol operates on port 993 and provides encrypted access to mailboxes on a server?
- SMTP over TLS
- IMAP over SSL (IMAPS) (Correct answer)
- POP3 over SSL
- MAPI over HTTP
Correct answer: IMAP over SSL (IMAPS)
IMAPS (IMAP over SSL/TLS) operates on port 993 and provides encrypted, server-side mailbox access while keeping messages stored on the server.
Question 3: What is the primary forensic difference between POP3 and IMAP email retrieval in terms of evidence location?
- POP3 uses encryption while IMAP does not
- POP3 typically downloads and deletes messages from the server; IMAP keeps messages server-side (Correct answer)
- IMAP stores emails in PST format; POP3 uses MBOX
- POP3 is only used for corporate email; IMAP is consumer-only
Correct answer: POP3 typically downloads and deletes messages from the server; IMAP keeps messages server-side
POP3 downloads messages to the client and commonly deletes them from the server, making the local device the primary evidence source, while IMAP maintains the authoritative copy server-side.
Question 4: During analysis, an examiner notices that the 'Date:' header in an email is several hours different from the 'Received:' timestamps. What might this indicate?
- The email was encrypted during transit
- The sender's system clock was incorrect or the date was manually altered to mislead investigators (Correct answer)
- The email bounced between servers multiple times
- The message was flagged by a spam filter
Correct answer: The sender's system clock was incorrect or the date was manually altered to mislead investigators
A significant discrepancy between the Date: header (set by the sender's client) and Received: timestamps (set by servers) can indicate a misconfigured clock or deliberate timestamp manipulation.
Question 5: What does S/MIME provide in the context of email security that is forensically significant?
- Anonymization of sender IP addresses
- Digital signatures and encryption of message content (Correct answer)
- Automatic spam filtering
- Header field obfuscation
Correct answer: Digital signatures and encryption of message content
S/MIME provides public-key-based digital signatures (authenticating sender identity) and end-to-end encryption of message content, which may require certificate recovery to decrypt evidence.
Question 6: In an EnCase investigation, what is the role of hash analysis when processing email attachments?
- To compress attachments for faster analysis
- To verify file integrity and match attachments against known-good or known-bad hash libraries (Correct answer)
- To decrypt password-protected attachments
- To convert attachment formats to a readable type
Correct answer: To verify file integrity and match attachments against known-good or known-bad hash libraries
Hash analysis computes MD5/SHA values for attachments and compares them against hash sets (such as NSRL for known-good or CAID for contraband) to quickly classify files.
Question 7: Which of the following best describes a 'header injection' attack relevant to email forensics?
- Injecting SQL commands into email subject lines to attack databases
- Inserting additional email headers through unsanitized user input fields to manipulate routing or add BCC recipients (Correct answer)
- Using email to deliver executable payloads to mail servers
- Forging the DKIM signature in email headers
Correct answer: Inserting additional email headers through unsanitized user input fields to manipulate routing or add BCC recipients
Header injection exploits web forms that pass user input directly into email headers, allowing attackers to add headers like BCC to redirect copies of emails or abuse mail servers as spam relays.
EnCE Email Forensics 5
An examiner finds email messages in unallocated clusters.
What forensic technique enabled this recovery?