Which artifact typically reveals the route an email took from sender to recipient, including servers it passed through?

Which artifact typically reveals the route an email took from sender to recipient, including servers it passed through?

• A. Internet backbone trace
• B. E-mail header
• C. MAC address table
• D. DNS cache

Answer: (B)

The path an email took is recorded in the email's header. The header includes a chain of Received lines, with each mail transfer agent (MTA) that handles the message adding its own entry. These entries show the server that handled the email, along with timestamps and sometimes IP addresses, creating a hop-by-hop route from the sender to the recipient. This embedded routing trail is the primary forensic artifact for reconstructing how the message moved across servers. Why this fits best: since the information is carried with the message itself, it stays with the email as it travels, making it the most reliable source to trace the actual path taken. Other items—like a network backbone trace, a MAC address table, or a DNS cache—lie outside the email data: the backbone trace is a diagnostic path outside the message, the MAC table is a switch’s internal mapping on a local network, and the DNS cache stores domain lookups rather than the message’s transmission history.

The path an email took is recorded in the email's header. The header includes a chain of Received lines, with each mail transfer agent (MTA) that handles the message adding its own entry. These entries show the server that handled the email, along with timestamps and sometimes IP addresses, creating a hop-by-hop route from the sender to the recipient. This embedded routing trail is the primary forensic artifact for reconstructing how the message moved across servers.

Why this fits best: since the information is carried with the message itself, it stays with the email as it travels, making it the most reliable source to trace the actual path taken. Other items—like a network backbone trace, a MAC address table, or a DNS cache—lie outside the email data: the backbone trace is a diagnostic path outside the message, the MAC table is a switch’s internal mapping on a local network, and the DNS cache stores domain lookups rather than the message’s transmission history.