Deck 11: Live Acquisitions and Network Forensics

Question 1

The _______________ utility can be used to repair .ost and .pst files, and is included with Microsoft Outlook.​

A)​repairpst.exe
B)​fixmail.exe
C)scanpst.exe
D)rebuildpst.exe

Answer 1

C

Question 2

What type of Facebook profile is usually only given to law enforcement with a warrant?​

A)basic profile
B)​Neoprint profile
C)advanced profile
D)private profile

Answer 2

B

Question 3

Committing crimes with e-mail is uncommon, and investigators are not generally tasked with linking suspects to e-mail.​

Answer 3

False

Question 4

Which option below is the correct path to the sendmail configuration file?​

A)​​/ var​/ mail​/ sendmail.cf
B)​​/ usr​/ local​/ sendmail.cf
C)​/ etc​/ mail​/ sendmail.cf
D)​/ var​/ etc​/ sendmail.cf

Question 5

What kind of files are created by Exchange while converting binary data to readable text in order to prevent loss of data?​

A)​.txt
B)​.log
C).tmp
D).exe

Question 6

What information is not typically included in an e-mail header?​

A)​The originating IP address
B)​The sender's physical location
C)The originating domain
D)The unique ID of the e-mail

Question 7

One of the most noteworthy e-mail scams was 419, otherwise known as the _______________.​

A)​Iloveyou Scam
B)​Conficker virus
C)Nigerian Scam
D)Lake Venture Scam

Question 8

​The DomainKeys Identified Mail service is a way to verify the names of domains a message is flowing through and was developed as a way to cut down on spam.

Question 9

Syslog is generally configured to put all e-mail related log information into what file?​

A)​​/ var​/ log​/ messages
B)​​/ var​/ log​/ maillog
C)​/ usr​/ log​/ mail.log
D)​/ proc​/ mail

Question 10

On a UNIX system​, where is a user's mail stored by default?

A)​​/ username​/ mail
B)​​/ home​/ username​/ mail
C)​/ var​/ log​/ mail
D)​/ var​/ mail

Question 11

Which e-mail recovery program below can recover files from VMware and VirtualPC virtual machines, as well as ISOs and other types of file backups?

A)AccessData FTK​
B)​EnCase Forensics
C)DataNumen Outlook Repair
D)Fookes Aid4mail

Question 12

The Suni Munshani v. Signal Lake Venture Fund II, LP et al case is an example of a case that involves e-mail ____________.​

A)​destruction
B)​spoofing
C)spamming
D)theft

Question 13

The Pagefile.sys file on a computer can contain message fragments from instant messaging applications

Question 14

​Select the program below that can be used to analyze mail from Outlook, Thunderbird, and Eudora.

A)​AccessData FTK
B)​R-Tools R-Mail
C)DataNumen
D)Fookes Aid4Mail

Question 15

What command below could be used on a UNIX system to help locate log directories?​

A)​detail
B)​show log
C)search
D) find​

Question 16

An Internet e-mail server is generally part of a local network, and is maintained and managed by an administrator for internal use by a specific company.​

Question 17

In an e-mail address, everything before the @ symbol represents the domain name.​

Question 18

Where does the Postfix UNIX mail server store e-mail?​

A)​​/ etc​/ postfix
B)​​/ var​/ mail​/ postfix
C)​/ home​/ username​/ mail
D)​/ var​/ spool​/ postfix

Question 19

​In older versions of exchange, what type of file was responsible for messages formatted with Messaging Application Programming Interface, and served as the database file?

A)​.edi
B)​.edp
C).ost
D).edb

Question 20

​In what state is sending unsolicited e-mail illegal?

A)​Maine
B)​New York
C)Florida
D)Washington

Question 21

Match the following terms with the correct definition below:

-A protocol for retrieving e-mail messages; it's slowly replacing POP3.

A)client server ?/ architecture
B)Electronic Communications Privacy Act (ECPA)
C)Enhanced?/ Extended Simple Mail Transfer Protocol (ESMTP)
D)Internet Message Access Protocol 4 (IMAP4)
E)mbox
F)Messaging Application Programming Interface (MAPI)
G)Multipurpose Internet Mail Extensions (MIME)
H)online social networks (OSNs)
I)pharming
J)phishing

Question 22

Match the following terms with the correct definition below:

-A law enacted in 1986 to extend the Wiretap Act to cover e-mail and other data transmitted via the Internet.?

A)client server ?/ architecture
B)Electronic Communications Privacy Act (ECPA)
C)Enhanced?/ Extended Simple Mail Transfer Protocol (ESMTP)
D)Internet Message Access Protocol 4 (IMAP4)
E)mbox
F)Messaging Application Programming Interface (MAPI)
G)Multipurpose Internet Mail Extensions (MIME)
H)online social networks (OSNs)
I)pharming
J)phishing

Question 23

Match the following terms with the correct definition below:

-?A term researchers use for social media.

A)client server ?/ architecture
B)Electronic Communications Privacy Act (ECPA)
C)Enhanced?/ Extended Simple Mail Transfer Protocol (ESMTP)
D)Internet Message Access Protocol 4 (IMAP4)
E)mbox
F)Messaging Application Programming Interface (MAPI)
G)Multipurpose Internet Mail Extensions (MIME)
H)online social networks (OSNs)
I)pharming
J)phishing

Question 24

Match the following terms with the correct definition below:

-A type of e-mail scam that uses DNS poisoning to redirect readers to a fake
Web site.?

A)client server ?/ architecture
B)Electronic Communications Privacy Act (ECPA)
C)Enhanced?/ Extended Simple Mail Transfer Protocol (ESMTP)
D)Internet Message Access Protocol 4 (IMAP4)
E)mbox
F)Messaging Application Programming Interface (MAPI)
G)Multipurpose Internet Mail Extensions (MIME)
H)online social networks (OSNs)
I)pharming
J)phishing

Question 25

?Exchange servers maintain message logs in the ________________ log file.

Question 26

?The ____________________ includes logging instructions and is located within the ?/ etc directory. It determines what happens to an e-mail when it is logged: the event, priority level, and the action taken.

Question 27

E-mail administrators may make use of _________________, which overwrites a log file when it reaches a specified size or at the end of a specified time frame.​

A)​log cycling
B)​circular logging
C)log recycling
D)log purging

Question 28

Similar to ARIN, the ____________ can be used to find a domain's IP address and point of contact.?

Question 29

Which service below does not put log information into ​/ var​/ log​/ maillog?​

A)​Exchange
B)​SMTP
C)POP
D)IMAP

Question 30

Match the following terms with the correct definition below:

-?A network architecture in which each computer or process on the network is a client or server. Clients request services from a server, and a server processes requests from clients.

A)client server ?/ architecture
B)Electronic Communications Privacy Act (ECPA)
C)Enhanced?/ Extended Simple Mail Transfer Protocol (ESMTP)
D)Internet Message Access Protocol 4 (IMAP4)
E)mbox
F)Messaging Application Programming Interface (MAPI)
G)Multipurpose Internet Mail Extensions (MIME)
H)online social networks (OSNs)
I)pharming
J)phishing

Question 31

What service below can be used to map an IP address to a domain name, and then find the domain name's ​point of contact?

A)​Google
B)​ERIN
C)iNet
D)ARIN

Question 32

The ___________ UNIX e-mail server has two primary configuration files, master.cf and main.cf​

Question 33

Many web-based e-mail providers offer _______________ services, such as Yahoo! Messenger and Google Talk.
a.​client server ​/ architecture

Question 34

Match the following terms with the correct definition below:

-?A method of storing e-mail messages in a flat plaintext file

A)client server ?/ architecture
B)Electronic Communications Privacy Act (ECPA)
C)Enhanced?/ Extended Simple Mail Transfer Protocol (ESMTP)
D)Internet Message Access Protocol 4 (IMAP4)
E)mbox
F)Messaging Application Programming Interface (MAPI)
G)Multipurpose Internet Mail Extensions (MIME)
H)online social networks (OSNs)
I)pharming
J)phishing

Question 35

Exchange uses an Exchange database and is based on the _______________________, which uses several files in different combinations to provide e-mail service.?

A)?Microsoft Extended Mail Storage (EMS)
B)?Microsoft Mail Storage Engine (MSE)
C)Microsoft Extensible Storage Engine (ESE)
D)Microsoft Stored Mail Extensions (SME)

Question 36

In order to retrieve logs from exchange, the PowerShell cmdlet _______________________ can be used.​

A)​GetLogInfo.ps1
B)​GetTransactionLogStats.ps1
C)GetExchangeLogs.ps1
D)ShowExchangeHistory.ps1

Question 37

Match the following terms with the correct definition below:

-?A type of e-mail scam that's typically sent as spam soliciting personal identity information that fraudsters can use for identity theft.

A)client server ?/ architecture
B)Electronic Communications Privacy Act (ECPA)
C)Enhanced?/ Extended Simple Mail Transfer Protocol (ESMTP)
D)Internet Message Access Protocol 4 (IMAP4)
E)mbox
F)Messaging Application Programming Interface (MAPI)
G)Multipurpose Internet Mail Extensions (MIME)
H)online social networks (OSNs)
I)pharming
J)phishing

Question 38

Match the following terms with the correct definition below:

-?A specification for formatting non-ASCII messages, such as graphics, audio, and video, for transmission over the Internet.

A)client server ?/ architecture
B)Electronic Communications Privacy Act (ECPA)
C)Enhanced?/ Extended Simple Mail Transfer Protocol (ESMTP)
D)Internet Message Access Protocol 4 (IMAP4)
E)mbox
F)Messaging Application Programming Interface (MAPI)
G)Multipurpose Internet Mail Extensions (MIME)
H)online social networks (OSNs)
I)pharming
J)phishing

Question 39

Match the following terms with the correct definition below:

-?An enhancement of SMTP for sending and receiving e-mail messages. ESMTP generates a unique, nonrepeatable number that's added to a transmitted e-mail. No two messages transmitted from an e-mail server have the same ESMTP value.

A)client server ?/ architecture
B)Electronic Communications Privacy Act (ECPA)
C)Enhanced?/ Extended Simple Mail Transfer Protocol (ESMTP)
D)Internet Message Access Protocol 4 (IMAP4)
E)mbox
F)Messaging Application Programming Interface (MAPI)
G)Multipurpose Internet Mail Extensions (MIME)
H)online social networks (OSNs)
I)pharming
J)phishing

Question 40

Match the following terms with the correct definition below:

-The Microsoft system that enables other e-mail applications to work with each other?

A)client server ?/ architecture
B)Electronic Communications Privacy Act (ECPA)
C)Enhanced?/ Extended Simple Mail Transfer Protocol (ESMTP)
D)Internet Message Access Protocol 4 (IMAP4)
E)mbox
F)Messaging Application Programming Interface (MAPI)
G)Multipurpose Internet Mail Extensions (MIME)
H)online social networks (OSNs)
I)pharming
J)phishing

Question 41

Describe the e-mail client ​/ server architecture.

Question 42

List three (3) web pages that can be used to determine point of contact for a domain, and describe how each is used.​

Question 43

Describe the Nigerian scam​.

Question 44

​How can routers be used to determine the path of an e-mail?

Question 45

​What is Exchange, and what information within Exchange is most valuable to investigations?

Question 46

Describe the two different types of Facebook profiles.

Question 47

​What is the syslog.conf file, and how is it used?

Question 48

Explain some of the difficulties in using social media sites as sources of forensic data.​

Question 49

After a crime has been committed involving e-mail, how should forensics investigators proceed?​

Question 50

Compare and contrast email services on Internet and an intranet.