Question 1

For older UNIX applications, such as mail or mailx, you can print the e-mail headers by using the ____ command.

Accepted Answer

The correct command to print the email headers for older UNIX applications like mail or mailx is "print".

Question 2

With many ____ e-mail programs, you can copy an e-mail message by dragging the message to a storage medium, such as a folder or disk.

Accepted Answer

Graphical User Interface (GUI) is the type of program that allows the user to drag and drop files or messages to transfer them to a different location. Command-line, shell-based, and prompt-based programs typically require the user to input commands through a text interface, making it harder to copy messages through dragging and dropping.

Question 3

E-mail messages are distributed from one central server to many connected client computers, a configuration called ____.

Accepted Answer

The described configuration, with one central server distributing messages to many client computers, is an example of client/server architecture.

Question 4

To view AOL e-mail headers click Action, ____ from the menu.

Accepted Answer

To view AOL e-mail headers, you need to click "View Message Source" from the menu. This will open a new window with the complete email headers for the selected message, which can contain important information about the message's path and origin.

Question 5

For computer investigators, tracking intranet e-mail is relatively easy because the accounts use standard names established by the network or e-mail administrator.

Accepted Answer

Intranet e-mail accounts usually use standard names established by the network or e-mail administrator, which makes it easier for computer investigators to track them compared to external e-mails.

Question 6

Typically, UNIX installations are set to store logs such as maillog in the ____ directory.

Accepted Answer

The best choice is D because /var/log is the standard directory used in UNIX installations to store log files, including maillog. Options A and B are not valid directory locations, and option C is incorrect as it includes an extra /etc directory in the path.

Question 7

Like UNIX e-mail servers, Exchange maintains logs to track e-mail communication.

Accepted Answer

Exchange, like many other email servers, maintains logs to track email communication for various purposes such as troubleshooting, auditing, and compliance. These logs contain information such as when an email was sent or received, the sender and recipient email addresses, the email message ID, and other relevant information.

Question 8

In an e-mail address, everything after the ____ symbol represents the domain name.

Accepted Answer

In an e-mail address, everything after the "@" symbol represents the domain name.

Question 9

To retrieve an Outlook Express e-mail header right-click the message, and then click ____ to open a dialog box showing general information about the message.

Accepted Answer

Right-clicking on the email and selecting "Properties" will open a dialog box with general information about the message, including the email header. Options and Details do not provide access to the email header, and Message Source is not an option in Outlook Express.

Question 10

To view e-mail headers on Yahoo! click the ____ link in the Mail Options window, and then click Show all headers on incoming messages.

Accepted Answer

The correct option is "General Preferences" because in Yahoo! Mail, to view the full email headers, you would navigate to the Mail Options or Settings section and look for an option related to viewing or displaying email messages, where "General Preferences" is the relevant section for adjusting how emails are displayed, including the option to show all headers.

Question 11

To retrieve e-mail headers in Microsoft Outlook, right-click the e-mail message, and then click ____ to open the Message Options dialog box. The Internet headers text box at the bottom of the dialog box contains the message header.

Accepted Answer

In Microsoft Outlook, to retrieve e-mail headers, you right-click the e-mail message and then click "Options" to open the Message Options dialog box, where you can find the Internet headers text box at the bottom.

Question 12

In Exchange, to prevent loss of data from the last backup, a ____ file or marker is inserted in the transaction log to mark the last point at which the database was written to disk.

Accepted Answer

A checkpoint is a file or marker that is inserted in the transaction log to mark the last point at which the database was written to disk. It helps to prevent loss of data from the last backup by ensuring that all transactions committed since the last backup are written to disk before the backup is taken. This makes the recovery process much easier and faster, as the system only needs to apply the transactions that occurred after the last backup, rather than reapplying all transactions in the log.

Question 13

All e-mail servers are databases that store multiple users' e-mails.

Accepted Answer

E-mail servers manage the sending and receiving of emails but do not necessarily store emails in a database format; storage methods can vary.

Question 14

Exchange logs information about changes to its data in a(n) ____ log.

Accepted Answer

Exchange logs maintain a record of every transaction that occurs within the system. This log is known as the transaction log, and it is used to maintain integrity and consistency of data in the Exchange database. Checkpoint logs are used to store information about the state of the database during backup operations, and communication logs track communications between Exchange servers. Tracking logs are used to monitor the delivery status of messages in Exchange.

Question 15

You can always rely on the return path in an e-mail header to show the source account of an e-mail message.

Accepted Answer

The return path in an e-mail header can be spoofed or manipulated, and may not always show the actual source account of the e-mail message. Therefore, it is not always reliable.

Question 16

E-mail programs either save e-mail messages on the client computer or leave them on the server.

Accepted Answer

E-mail programs can be configured to either save the messages on the client computer or leave them on the server depending on the user's preferences and settings.

Question 17

____ is a comprehensive Web site that has options for searching for a suspect, including by e-mail address, phone numbers, and names.

Accepted Answer

www.freeality.com offers a variety of search tools, including the ability to search for individuals by email address, phone numbers, and names, making it a comprehensive resource for such inquiries.

Question 18

When working on a Windows environment you can press ____ to copy the selected text to the clipboard.

Accepted Answer

When working on a Windows environment, the keyboard shortcut "Ctrl + C" is used to copy the selected text to the clipboard. "Ctrl + A" is used to select all the text, "Ctrl + V" is used to paste the copied text, and "Ctrl + Z" is used to undo the previous action.

Question 19

____ allocates space for a log file on the server, and then starts overwriting from the beginning when logging reaches the end of the time frame or the specified log size.

Accepted Answer

Circular logging is a method of logging where space is allocated for a log file on the server, and when logging reaches the end of the time frame or the specified log size, it starts overwriting from the beginning. This ensures that the log file does not grow indefinitely and that the server does not run out of space. Continuous logging and automatic logging are not specific methods of logging, whereas server logging is a broad term that encompasses all types of logging that occur on a server.

Question 20

____ contains configuration information for Sendmail, allowing the investigator to determine where the log files reside.

Accepted Answer

The configuration information for Sendmail is stored in the file /etc/sendmail.cf, which includes information about log file locations.

Answer: D 
 The log files themselves are typically stored in /var/log/maillog, but this does not contain configuration information for Sendmail.

Quiz 12: E-Mail Investigations