Deck 8: E-Mail and Webmail Forensics

Question 1

The logical address of the sender is composed of two parts:

A)The client name and the hostname
B)The mailbox and the domain or hostname
C)The server name and the client name
D)The POP3 name and the SMTP name

Answer 1

B

Question 2

Which of the following are NOT considered important when working with RAID systems?

A)Transmission speed
B)Type of controller
C)Size of array
D)Type of hard drive

Answer 2

D

Question 3

If you found the mail[#] keyword in an evidence search,you could assume the user has access to the ________ webmail program.

Answer 3

Gmail

Question 4

What portion of an e-mail records such information as the identity of the creator?

A)The trailer
B)The body
C)The header
D)None of these

Question 5

What percentage of firms have said they have fired workers for Internet misuse?

A)45 percent
B)22 percent
C)35 percent
D)26 percent

Question 6

Which of the following file extensions would most likely be found in an e-mail search for someone using Outlook?

A).eml
B).wab
C).dbx
D).mbx

Question 7

Which RAID array uses a minimum of three disks,two for striping and one to store parity information?

A)RAID 9
B)RAID 5
C)RAID 3
D)RAID 1

Question 8

Where is the best place to look for evidence that a person has been using webmail?

A)\Documents and Settings\Windowsuserid\Local Settings\Temp
B)\Documents and Settings\Windowsuserid\Local Settings\Temporary Internet Files
C)\Documents and Settings\Windowsuserid\Local Settings\Temporary Files
D)\Documents and Settings\Windowsuserid\Local Settings\Internet Files

Question 9

?Working with mail servers can be a challenge for all of the following reasons EXCEPT

A)These programs service hundreds or even thousands of accounts
B)It may not be possible to get forensic access to the accounts
C)Servers are particularly hard to access in small companies
D)Companies may have policies in place to limit the time data is retained

Question 10

Because there is no one standard for instant messaging,

A)Messages often have widely differing formats
B)Both IM participants typically have to use the same chat software
C)IM is generally not used for business purposes
D)An investigator may have to use a generic program to access messages

Question 11

Of the following,which is NOT considered a Regional Internet Registry?

A)AfriNIC
B)APNIC
C)LATNIC
D)ARIN

Question 12

E-mail attachments can be found within slack space by searching for

A)The keyword base64
B)The keyword base32
C)The keyword base16
D)The keyword base8

Question 13

Which of the following is NOT a webmail program?

A)Yahoo!Mail
B)Hotmail
C)LotusMail
D)Gmail

Question 14

Which e-mail program comes with Microsoft Office?

A)Outlook
B)Outlook Express
C)Eudora
D)Office Notes

Question 15

A person using webmail may be able to use a program such as ________ to connect to the server and thus download messages to work with offline.

Question 16

E-mail software is a(n)________ program that works in concert with a(n)________.

Question 17

One of the challenges when trying to find webmail evidence is that

A)Webmail is more widely used than client programs
B)Webmail accounts are harder to access
C)Webmail accounts are easier to use
D)E-mails from webmail accounts are not typically stored on the user's computer

Question 18

In Outlook Express,each e-mail account is given a Microsoft ________,which is a unique hexadecimal representation for that account.

Question 19

You can look in the ________ folder to find applications such as Eudora or Lotus Notes.

Question 20

E-mail client programs are generally configured to communicate with

A)One or more servers
B)One or more hosts
C)A single user account
D)Internet clients

Question 21

________ uses two or more hard drives accessed in parallel to create a pool of storage.

Question 22

The tool often used for quick communications without resorting to e-mail is________ .

Question 23

According to many Americans,________ violate their privacy and their First Amendment rights.

Question 24

A(n)________ server resolves domain names to IP addresses.

Question 25

Attachments are normally handled using a(n)_______ binary-to-text encoding scheme.

Question 26

Error-corrective coding (ECC),also known as ________,is used to check the validity of striped data.

Question 27

To handle attachments now being included in e-mail,________ ,a new standard,was introduced.

Question 28

The ________ comes before the @ sign in an e-mail address

Question 29

________ is writing the same data in two places.

Question 30

A check of the ________ will determine how long a company keeps e-mails.