CHFI Email and Social Media Forensics 2 — Questions and Answers
Question 1: In which location does Microsoft Outlook store emails, contacts, and calendar data in a local file format?
- .eml file
- .pst or .ost file (Correct answer)
- .msg file
- .mbox file
Correct answer: .pst or .ost file
Outlook stores local email data in Personal Storage Table (.pst) files for local storage and Offline Storage Table (.ost) files for cached Exchange mailbox data.
Question 2: Which forensic tool is widely used to parse and examine Outlook PST files during email investigations?
- Volatility
- Kernel OST/PST Viewer or FTK with PST support (Correct answer)
- Nessus
- Aircrack-ng
Correct answer: Kernel OST/PST Viewer or FTK with PST support
Tools like Kernel OST/PST Viewer and FTK's email module can parse PST/OST files to recover emails, deleted items, and metadata without requiring Outlook to be installed.
Question 3: What does the 'Date' field in an email header represent, and why must investigators treat it with caution?
- The date the email was received by the destination server, which is always accurate
- The date set by the sender's email client, which can be manipulated by the sender (Correct answer)
- The date the email was scanned by antivirus
- The date the email was backed up
Correct answer: The date set by the sender's email client, which can be manipulated by the sender
The Date header is set by the sender's mail client and can be manually altered, so investigators should corroborate it against 'Received' header timestamps from mail servers.
Question 4: When investigating a social media account on Facebook, which legal process in the US must law enforcement typically follow to obtain private user data from Meta?
- Informal request via email to Meta
- Subpoena, court order, or search warrant depending on the data type (Correct answer)
- FOIA request
- DNS lookup
Correct answer: Subpoena, court order, or search warrant depending on the data type
Under the Stored Communications Act (SCA), law enforcement must use a subpoena for basic subscriber info, a court order for non-content records, and a search warrant for private message content.
Question 5: What type of data can be recovered from a Facebook account's 'Download Your Information' feature that is useful in forensic investigations?
- Only profile photos
- Messages, posts, friends list, login activity, and location history (Correct answer)
- Only public posts
- Only payment information
Correct answer: Messages, posts, friends list, login activity, and location history
Facebook's Download Your Information feature exports a comprehensive archive including private messages, post history, friend connections, IP-based login activity, and location data.
Question 6: In social media forensics, what is the significance of metadata embedded in images posted on social platforms?
- It only contains file size information
- It may contain GPS coordinates, device model, and timestamp revealing the photo's origin (Correct answer)
- It contains the user's password hash
- It only contains image resolution data
Correct answer: It may contain GPS coordinates, device model, and timestamp revealing the photo's origin
EXIF metadata in images can include GPS coordinates, camera model, and capture timestamp, though many social platforms strip EXIF data — investigators must check if the platform preserves it.
CHFI Email and Social Media Forensics 2
In which location does Microsoft Outlook store emails, contacts, and calendar data in a local file format?