Questions - Understanding Email Servers and Using Specialized Email Forensics Tools

Logging options on e-mail servers can be which of the following?

• Disabled by users

• Configured to a specified size before being overwritten

• Typically set to periodic logging mode

On a UNIX-like system, which file specifies where to save different types of e-mail log files?

• maillog

• /var/spool/log

• syslog.conf

• log

Which of the following types of files can provide useful information when you’re examining an e-mail server?

• .dbf files

• .emx files

• .log files

• .slf files

When confronted with an e-mail server that no longer contains a log with the date information you require for your investigation, and the client has deleted the e-mail, what should you do?

• Search available log files for any forwarded messages.

• Restore the e-mail server from a backup.

• Check the current database files for an existing copy of the e-mail.

• Do nothing because after the file has been deleted, it can no longer be recovered.

To analyze e-mail evidence, an investigator must be knowledgeable about an e-mail server’s internal operations.

• True

• False

Sendmail uses which file for instructions on processing an e-mail message?

• sendmail.cf

• syslogd.conf

• mese.ese

• mapi.log

Which of the following is a current formatting standard for e-mail?

• SMTP

• MIME

• Outlook

• HTML