EnCE Email Forensics 5

Question 1

An examiner finds email messages in unallocated clusters. What forensic technique enabled this recovery?

Accepted Answer

File carving based on email header signatures

Answer

File carving searches unallocated space for known file headers and footers (such as MIME boundaries or PST signatures) to reconstruct deleted files without relying on filesystem metadata.

Question 2

Which email protocol operates on port 993 and provides encrypted access to mailboxes on a server?

Accepted Answer

IMAP over SSL (IMAPS)

Answer

IMAPS (IMAP over SSL/TLS) operates on port 993 and provides encrypted, server-side mailbox access while keeping messages stored on the server.

Question 3

What is the primary forensic difference between POP3 and IMAP email retrieval in terms of evidence location?

Accepted Answer

POP3 typically downloads and deletes messages from the server; IMAP keeps messages server-side

Answer

POP3 downloads messages to the client and commonly deletes them from the server, making the local device the primary evidence source, while IMAP maintains the authoritative copy server-side.

Question 4

During analysis, an examiner notices that the 'Date:' header in an email is several hours different from the 'Received:' timestamps. What might this indicate?

Accepted Answer

The sender's system clock was incorrect or the date was manually altered to mislead investigators

Answer

A significant discrepancy between the Date: header (set by the sender's client) and Received: timestamps (set by servers) can indicate a misconfigured clock or deliberate timestamp manipulation.

Question 5

What does S/MIME provide in the context of email security that is forensically significant?

Accepted Answer

Digital signatures and encryption of message content

Answer

S/MIME provides public-key-based digital signatures (authenticating sender identity) and end-to-end encryption of message content, which may require certificate recovery to decrypt evidence.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Email Forensics 5