CHFI Email and Social Media Forensics 3

Question 1

Which protocol is used to retrieve email from a mail server and keeps messages stored server-side, making it critical for cloud-based email forensics?

Accepted Answer

IMAP

Answer

POP3

Answer

SMTP

Answer

FTP

Question 2

What is 'email spoofing' and what forensic technique helps identify it?

Accepted Answer

Forging the From address to impersonate another sender; identified by analyzing Received headers and DKIM/SPF results

Answer

Encrypting emails; decrypted by checking certificates

Answer

Deleting sent emails; recovered by log analysis

Answer

Compressing email attachments; identified by file signatures

Question 3

Which artifact on a Windows system stores evidence of web-based email access (e.g., Gmail via browser) useful in email forensics?

Accepted Answer

Browser cache, history, and cookies

Answer

Registry hives only

Answer

Prefetch files only

Answer

Windows Event Logs only

Question 4

In investigating a Twitter/X account for evidence, which API does law enforcement reference for legal data requests to the platform?

Accepted Answer

Twitter's Legal Request Submission portal under the Stored Communications Act

Answer

Twitter Developer API v2 public endpoints

Answer

Google Safe Browsing API

Answer

WHOIS API

Question 5

What is the purpose of analyzing the 'Bcc' (Blind Carbon Copy) field in email forensics investigations?

Accepted Answer

Bcc recipients are hidden from other recipients but may appear in server logs or sender's sent folder, revealing hidden communication parties

Answer

Bcc is always visible in email headers and easy to read

Answer

Bcc encrypts the email content

Answer

Bcc prevents the email from being forwarded

Question 6

Which hashing algorithm is recommended by NIST for generating forensic integrity hashes of email evidence files such as PST archives?

Accepted Answer

SHA-256 or SHA-3

Answer

MD5 alone

Answer

CRC32

Answer

Base64 encoding