What information do you need to recover when searching a victim computer for a crime committed with a specific e-mail message?

What information do you need to recover when searching a victim computer for a crime committed with a specific e-mail message?

• A. Internet service provider information
• B. Username and password
• C. E-mail header
• D. Firewall log

Answer: (C)

The information you want to recover is found in the e-mail header. The header contains metadata such as the sender, recipient, dates, and the path the message traveled through multiple mail servers. By examining the Received lines and the Message-ID, you can trace the route of the e-mail and identify where it originated, which is crucial for linking the message to a source and validating its timing and delivery. This header is the most direct evidence on a victim’s machine for reconstructing who sent the message and how it got to its recipient. ISP information lives outside the victim’s machine and isn’t reliably retrievable from local files. Usernames and passwords are credentials that aren’t the primary evidence for tracing an e-mail's origin. Firewall logs show network activity but don’t provide the specific content or routing details of a particular e-mail message.

The information you want to recover is found in the e-mail header. The header contains metadata such as the sender, recipient, dates, and the path the message traveled through multiple mail servers. By examining the Received lines and the Message-ID, you can trace the route of the e-mail and identify where it originated, which is crucial for linking the message to a source and validating its timing and delivery. This header is the most direct evidence on a victim’s machine for reconstructing who sent the message and how it got to its recipient.

ISP information lives outside the victim’s machine and isn’t reliably retrievable from local files. Usernames and passwords are credentials that aren’t the primary evidence for tracing an e-mail's origin. Firewall logs show network activity but don’t provide the specific content or routing details of a particular e-mail message.