Deck 12: E-Mail Investigations

Question 1

For older UNIX applications, such as mail or mailx, you can print the e-mail headers by using the ____ command.

A) prn
B) print
C) prnt
D) prt

Answer 1

B

Question 2

With many ____ e-mail programs, you can copy an e-mail message by dragging the message to a storage medium, such as a folder or disk.

A) command-line
B) shell-based
C) prompt-based
D) GUI

Answer 2

D

Question 3

E-mail messages are distributed from one central server to many connected client computers, a configuration called ____.

A) client/server architecture
B) central distribution architecture
C) client architecture
D) peer-to-peer architecture

Answer 3

A

Question 4

To view AOL e-mail headers click Action, ____ from the menu.

A) More options
B) Message properties
C) Options
D) View Message Source

Question 5

For computer investigators, tracking intranet e-mail is relatively easy because the accounts use standard names established by the network or e-mail administrator.

Question 6

Typically, UNIX installations are set to store logs such as maillog in the ____ directory.

A) /etc/Log
B) /log
C) /etc/var/log
D) /var/log

Question 7

Like UNIX e-mail servers, Exchange maintains logs to track e-mail communication.

Question 8

In an e-mail address, everything after the ____ symbol represents the domain name.

A) #
B) .
C) @
D) -

Question 9

To retrieve an Outlook Express e-mail header right-click the message, and then click ____ to open a dialog box showing general information about the message.

A) Properties
B) Options
C) Details
D) Message Source

Question 10

To view e-mail headers on Yahoo! click the ____ link in the Mail Options window, and then click Show all headers on incoming messages.

A) Advanced
B) General Preferences
C) Message Properties
D) More information

Question 11

To retrieve e-mail headers in Microsoft Outlook, right-click the e-mail message, and then click ____ to open the Message Options dialog box. The Internet headers text box at the bottom of the dialog box contains the message header.

A) Options
B) Details
C) Properties
D) Message Source

Question 12

In Exchange, to prevent loss of data from the last backup, a ____ file or marker is inserted in the transaction log to mark the last point at which the database was written to disk.

A) tracking
B) checkpoint
C) temporary
D) milestone

Question 13

All e-mail servers are databases that store multiple users' e-mails.

Question 14

Exchange logs information about changes to its data in a(n) ____ log.

A) checkpoint
B) communication
C) transaction
D) tracking

Question 15

You can always rely on the return path in an e-mail header to show the source account of an e-mail message.

Question 16

E-mail programs either save e-mail messages on the client computer or leave them on the server.

Question 17

____ is a comprehensive Web site that has options for searching for a suspect, including by e-mail address, phone numbers, and names.

A) www.freeality.com
B) www.google.com
C) www.whatis.com
D) www.juno.com

Question 18

When working on a Windows environment you can press ____ to copy the selected text to the clipboard.

A) Ctrl+A
B) Ctrl+C
C) Ctrl+V
D) Ctrl+Z

Question 19

____ allocates space for a log file on the server, and then starts overwriting from the beginning when logging reaches the end of the time frame or the specified log size.

A) Continuous logging
B) Automatic logging
C) Circular logging
D) Server logging

Question 20

____ contains configuration information for Sendmail, allowing the investigator to determine where the log files reside.

A) /etc/sendmail.cf
B) /etc/syslog.conf
C) /etc/var/log/maillog
D) /var/log/maillog

Question 21

In UNIX e-mail servers, the ____________________ file simply specifies where to save different types of e-mail log files.

Question 22

Match each item with a statement below:
a.Contacts
f.Notepad
b.Pico
g.CISCO Pix
c.syslogd file
h.www.whatis.com
d.www.arin.net
i.Pine
e.PU020101.db
text editor used with Windows

Question 23

Match each item with a statement below:
a.Contacts
f.Notepad
b.Pico
g.CISCO Pix
c.syslogd file
h.www.whatis.com
d.www.arin.net
i.Pine
e.PU020101.db
text editor used with UNIX

Question 24

GroupWise has ____ ways of organizing the mailboxes on the server.

A) 2
B) 3
C) 4
D) 5

Question 25

The Novell e-mail server software is called ____.

A) Sendmail
B) GroupWise
C) Sawmill
D) Guardian

Question 26

Match each item with a statement below:
a.Contacts
f.Notepad
b.Pico
g.CISCO Pix
c.syslogd file
h.www.whatis.com
d.www.arin.net
i.Pine
e.PU020101.db
Web site to check file extensions and match the file to a program

Question 27

Match each item with a statement below:
a.Contacts
f.Notepad
b.Pico
g.CISCO Pix
c.syslogd file
h.www.whatis.com
d.www.arin.net
i.Pine
e.PU020101.db
a network firewall device

Question 28

Describe the process of examining e-mail messages when you have access to the victim's computer and when this access is not possible.

Question 29

Match each item with a statement below:
a.Contacts
f.Notepad
b.Pico
g.CISCO Pix
c.syslogd file
h.www.whatis.com
d.www.arin.net
i.Pine
e.PU020101.db
includes e-mail logging instructions

Question 30

An e-mail address in the Return-Path line of an e-mail header is usually indicated as the ____________________ field in an e-mail message.

Question 31

Administrators usually set e-mail servers to ____________________ logging mode.

Question 32

You can send and receive e-mail in two environments:via the ____________________ or an intranet (an internal network).

Question 33

The GroupWise logs are maintained in a standard log format in the ____ folders.

A) MIME
B) mbox
C) QuickFinder
D) GroupWise

Question 34

Some e-mail systems store messages in flat plaintext files, known as a(n) ____ format.

A) POP3
B) mbox
C) MIME
D) SMTP

Question 35

Match each item with a statement below:
a.Contacts
f.Notepad
b.Pico
g.CISCO Pix
c.syslogd file
h.www.whatis.com
d.www.arin.net
i.Pine
e.PU020101.db
a registry Web site

Question 36

Match each item with a statement below:
a.Contacts
f.Notepad
b.Pico
g.CISCO Pix
c.syslogd file
h.www.whatis.com
d.www.arin.net
i.Pine
e.PU020101.db
command line e-mail program used with UNIX

Question 37

Match each item with a statement below:
a.Contacts
f.Notepad
b.Pico
g.CISCO Pix
c.syslogd file
h.www.whatis.com
d.www.arin.net
i.Pine
e.PU020101.db
the electronic address book in Outlook

Question 38

Match each item with a statement below:
a.Contacts
f.Notepad
b.Pico
g.CISCO Pix
c.syslogd file
h.www.whatis.com
d.www.arin.net
i.Pine
e.PU020101.db
the first folder the GroupWise server shares

Question 39

Vendor-unique e-mail file systems, such as Microsoft .pst or .ost, typically use ____________________ formatting, which can be difficult to read with a text or hexadecimal editor.

Question 40

Describe how e-mail account names are created on an intranet environment.

Question 41

Briefly explain how to use AccessData FTK to recover e-mails.

Question 42

Explain how to handle attachments during an e-mail investigation.

Question 43

What kind of information is normally included in e-mail logs?

Question 44

What are the steps for retrieving e-mail headers on Pine?

Question 45

What are the steps for viewing e-mail headers in Hotmail?

Question 46

Provide a brief description of Microsoft Exchange Server. Additionally, explain the differences between .edb and .stm files.

Question 47

Why are network router logs important during an e-mail investigation?

Question 48

What kind of information can you find in an e-mail header?