Title: Module Four Quiz
Course: CAP 2141 Digital Forensics II > Section: Module 4 E-mail Investigations

Q: Some e-mail systems store messages in flat plaintext files, known as a(n) ____ format.
- POP3
- mbox
- MIME
- SMTP
A: mbox

Q: The GroupWise logs are maintained in a standard log format in the ____ folders.
- MIME
- mbox
- QuickFinder
- GroupWise
A: GroupWise

Q: GroupWise has ____ ways of organizing the mailboxes on the server.
- 2
- 3
- 4
- 5
A: 2

Q: The Novell e-mail server software is called ____.
- Sendmail
- GroupWise
- Sawmill
- Guardian
A: GroupWise

Q: In Exchange, to prevent loss of data from the last backup, a ____ file or marker is inserted in the transaction log to mark the last point at which the database was written to disk.
- tracking
- checkpoint
- temporary
- milestone
A: checkpoint

Q: Exchange logs information about changes to its data in a(n) ____ log.
- checkpoint
- communication
- transaction
- tracking
A: transaction

Q: Typically, UNIX installations are set to store logs such as maillog in the ____ directory.
- /etc/Log
- /log
- /etc/var/log
- /var/log
A: /var/log

Q: ____ contains configuration information for Sendmail, allowing the investigator to determine where the log files reside.
- /etc/sendmail.cf
- /etc/syslog.conf
- /etc/var/log/maillog
- /var/log/maillog
A: /etc/sendmail.cf

Q: The files that provide helpful information to an e-mail investigation are log files and ____ files.
- batch
- configuration
- scripts
- .rts
A: configuration

Q: To retrieve e-mail headers in Microsoft Outlook, right-click the e-mail message, and then click ____ to open the Message Options dialog box. The Internet headers text box at the bottom of the dialog box contains the message header.
- Options
- Details
- Properties
- Message Source
A: Options

Q: To retrieve an Outlook Express e-mail header right-click the message, and then click ____ to open a dialog box showing general information about the message.
- Properties
- Options
- Details
- Message Source
A: Properties

Q: For older UNIX applications, such as mail or mailx, you can print the e-mail headers by using the ____ command.
- prn
- print
- prnt
- prt
A: print

Q: To view AOL e-mail headers click Action, ____ from the menu.
- More options
- Message properties
- Options
- View Message Source
A: View Message Source

Q: To view e-mail headers on Yahoo! click the ____ link in the Mail Options window, and then click Show all headers on incoming messages.
- Advanced
- General Preferences
- Message Properties
- More information
A: General Preferences

Q: Vendor-unique e-mail file systems, such as Microsoft .pst or .ost, typically use ____________________ formatting, which can be difficult to read with a text or hexadecimal editor.
A: Multipurpose Internet Mail Extensions (MIME) / Multipurpose Internet Mail Extensions / MIME / MIME (Multipurpose Internet Mail Extensions)

Q: In UNIX e-mail servers, the ____________________ file simply specifies where to save different types of e-mail log files.
A: syslog.conf

Q: Administrators usually set e-mail servers to ____________________ logging mode.
A: continuous

Q: An e-mail address in the Return-Path line of an e-mail header is usually indicated as the ____________________ field in an e-mail message.
A: Reply to

Q: Describe how e-mail account names are created on an intranet environment.

Q: Briefly explain how to use AccessData FTK to recover e-mails.