Email and Social Media Forensics Flashcards
6 cards from real CHFI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Email and Social Media Forensics flashcards as text
In which location does Microsoft Outlook store emails, contacts, and calendar data in a local file format?
Answer: .pst or .ost file
Outlook stores local email data in Personal Storage Table (.pst) files for local storage and Offline Storage Table (.ost) files for cached Exchange mailbox data.
Which forensic tool is widely used to parse and examine Outlook PST files during email investigations?
Answer: Kernel OST/PST Viewer or FTK with PST support
Tools like Kernel OST/PST Viewer and FTK's email module can parse PST/OST files to recover emails, deleted items, and metadata without requiring Outlook to be installed.
What does the 'Date' field in an email header represent, and why must investigators treat it with caution?
Answer: The date set by the sender's email client, which can be manipulated by the sender
The Date header is set by the sender's mail client and can be manually altered, so investigators should corroborate it against 'Received' header timestamps from mail servers.
When investigating a social media account on Facebook, which legal process in the US must law enforcement typically follow to obtain private user data from Meta?
Answer: Subpoena, court order, or search warrant depending on the data type
Under the Stored Communications Act (SCA), law enforcement must use a subpoena for basic subscriber info, a court order for non-content records, and a search warrant for private message content.
What type of data can be recovered from a Facebook account's 'Download Your Information' feature that is useful in forensic investigations?
Answer: Messages, posts, friends list, login activity, and location history
Facebook's Download Your Information feature exports a comprehensive archive including private messages, post history, friend connections, IP-based login activity, and location data.
In social media forensics, what is the significance of metadata embedded in images posted on social platforms?
Answer: It may contain GPS coordinates, device model, and timestamp revealing the photo's origin
EXIF metadata in images can include GPS coordinates, camera model, and capture timestamp, though many social platforms strip EXIF data — investigators must check if the platform preserves it.