CHFI Email and Social Media Forensics 1 — Questions and Answers
Question 1: Which email header field is most important for tracing the originating IP address of an email message?
- From
- Reply-To
- Received (Correct answer)
- Message-ID
Correct answer: Received
The 'Received' headers form a chain of mail server hops and the earliest 'Received' header contains the originating IP address of the sender.
Question 2: In email forensics, what does the 'X-Originating-IP' header reveal?
- The destination mail server IP
- The IP address of the client that originally submitted the email (Correct answer)
- The DNS server IP used for delivery
- The antivirus scanner IP
Correct answer: The IP address of the client that originally submitted the email
The X-Originating-IP header, added by some mail providers, records the IP address of the device that originally sent the email, which can identify the sender's location.
Question 3: Which tool is commonly used by CHFI investigators to analyze email headers and trace email origins?
- Wireshark
- MXToolbox Email Header Analyzer (Correct answer)
- Nmap
- Metasploit
Correct answer: MXToolbox Email Header Analyzer
MXToolbox Email Header Analyzer parses raw email headers to display the routing path, timestamps, and originating IP addresses in an investigator-friendly format.
Question 4: What is the forensic significance of the MIME (Multipurpose Internet Mail Extensions) structure in email investigation?
- It defines email routing rules
- It encodes attachments and multi-part content that may contain embedded malware or evidence (Correct answer)
- It encrypts email body content
- It authenticates sender domains
Correct answer: It encodes attachments and multi-part content that may contain embedded malware or evidence
MIME encoding allows emails to carry attachments and multi-part content; forensic investigators must decode MIME parts to extract and examine potentially malicious or evidential attachments.
Question 5: Which email authentication mechanism adds a digital signature to outgoing emails that can be verified to confirm the sender's domain integrity?
- SPF
- DKIM (Correct answer)
- DMARC
- MX record
Correct answer: DKIM
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the email header that allows receivers to verify the email was not altered and originated from the claimed domain.
Question 6: During an email forensics investigation, what does a missing or broken DMARC alignment indicate?
- The email was encrypted end-to-end
- The email may be a phishing attempt or spoofed to impersonate a legitimate domain (Correct answer)
- The email was sent via a mobile device
- The email server is overloaded
Correct answer: The email may be a phishing attempt or spoofed to impersonate a legitimate domain
Failed DMARC alignment indicates that SPF and/or DKIM checks failed, suggesting the email may be spoofed or sent by an unauthorized server impersonating the domain.
CHFI Email and Social Media Forensics 1
Which email header field is most important for tracing the originating IP address of an email message?