Unit 6: Email Crimes and Mobile Forensics - Practice Quiz

1 Which protocol is primarily used for sending email messages between servers?

2 Which part of an email contains routing information such as sender, receiver, and the path taken by the message?

3 What does the IMAP protocol allow a user to do?

4 Which of the following is a common example of an email crime?

5 During an email investigation, which element is examined first to trace the origin of a message?

6 Which U.S. law specifically regulates commercial email and spam?

7 The CAN-SPAM Act requires that commercial emails include which of the following?

8 Why are mobile devices important sources of evidence in investigations?

9 Mobile device forensics primarily deals with recovering evidence from which type of device?

10 Which operating system layer in Android is based on the Linux kernel?

11 Which company developed the iOS operating system?

12 Which of the following is typically the first phase of the mobile forensics process?

13 To prevent a seized phone from receiving remote wipe commands, investigators often use a:

14 Which record shows details of calls made and received, such as time and duration?

15 Cellular network data can help investigators approximate a device's:

16 What does SIM stand for in mobile devices?

17 Which type of data can commonly be recovered from a SIM card?

18 Gaining full administrative access on an Android device is known as:

19 The process of removing software restrictions on Apple iOS devices is called:

20 Logical acquisition of a mobile device retrieves:

21 An investigator examines an email header and finds multiple Received: fields. Which statement correctly describes how these should be read to trace the message path?

22 A suspect claims an email was sent from their account without authorization. Which protocol detail would MOST directly help verify whether the sending server was authorized to send on behalf of the domain?

23 During an email crime investigation, an examiner obtains a suspect's .pst file. What is the primary reason for creating a forensic copy before analysis?

24 An investigator needs to identify the originating IP address of a phishing email. Which single header field is the MOST reliable primary source for this information?

25 A company discovers an employee sending large volumes of deceptive commercial email with falsified header information. Which U.S. law most directly governs this conduct?

26 Under which U.S. statute could unauthorized access to another person's stored email on a service provider's system be prosecuted?

27 Why is mobile device forensics often considered more challenging than traditional computer forensics?

28 An investigator seizes a powered-on smartphone at a scene. What is the recommended immediate step to protect potential evidence from remote tampering?

29 In the Android architecture stack, which layer sits directly above the Linux kernel and provides hardware abstraction and core native libraries?

30 During the iOS secure boot chain, what is the primary role of the Boot ROM (SecureROM)?

31 Which sequence correctly represents the standard phases of the mobile forensics process?

32 An examiner documents every hash value, tool version, and action taken while processing a phone. Which forensic principle does this practice primarily support?

33 An investigator obtains Call Detail Records (CDRs) from a carrier. What type of evidence do CDRs primarily provide?

34 How can cell tower data from CDRs assist an investigation into a suspect's movements?

35 Within the SIM card's hierarchical file system, which element stores the phonebook and SMS-related data as elementary files?

36 When acquiring data from a SIM card, why should an examiner use a dedicated SIM reader rather than inserting the SIM back into an active phone?

37 What is the key forensic significance of rooting an Android device or jailbreaking an iOS device during acquisition?

38 A device uses a pattern lock on Android. Where is the gesture pattern data traditionally stored in a form an examiner might analyze?

39 Which statement BEST characterizes a logical acquisition of a mobile device?

40 An examiner uses an iTunes-style backup to perform logical acquisition of an iPhone. What can significantly limit the completeness of the extracted data?

41 An investigator analyzing an email header observes multiple Received: fields. To reconstruct the true path of the message and identify the originating server, which reading strategy and reasoning is correct?

42 During analysis, an investigator finds that the Return-Path, envelope-sender (MAIL FROM), and the header From: all differ. Which conclusion best reflects a legitimate technical explanation rather than automatically indicating spoofing?

43 A defendant sent bulk commercial emails using falsified header information and harvested addresses without offering an opt-out. Which U.S. statute most directly governs these specific violations?

44 An investigator wants to compel a provider to disclose the content of emails stored on a server for over 180 days. Under the Stored Communications Act (a part of the ECPA), which legal instrument has historically been referenced for such stored content?

45 An investigator recovers an email whose Received: chain shows an internal IP () in the originating hop, then a public IP. What is the correct forensic interpretation?

46 While validating a suspicious email, SPF passes but DKIM fails and DMARC is set to p=quarantine. Which interpretation is most defensible in an investigation?

47 Why does mobile device forensics require volatile-aware prioritization more urgently than typical disk forensics on a powered-off workstation?

48 In the Android architecture, an app calls a high-level API that ultimately triggers a hardware operation. Which ordering correctly reflects the layers traversed from top to bottom?

49 During the iOS secure boot chain, each stage cryptographically verifies the next. Which sequence correctly represents this chain of trust from power-on?

50 An examiner wants to load a custom recovery on an Android device. Which boot mode is designed to accept low-level flashing commands directly from a host over USB, and why is it forensically significant?

51 An investigator seizes a powered-on, unlocked smartphone at a scene. Which action sequence best preserves evidence and reduces contamination risk?

52 During examination, the hash of an extracted logical image differs from a re-extraction taken 20 minutes later on a running device. What is the most accurate interpretation?

53 In a Call Detail Record (CDR) analysis, a suspect's phone connected to a cell tower sector azimuthed at . Which conclusion is forensically sound about the device's location?

54 An investigator needs to distinguish a device across SIM swaps and a SIM across device swaps. Which identifier pairing is correct?

55 The SIM file system is hierarchical. Which structure correctly describes it, and where are SMS messages and phonebook entries typically stored?

56 An examiner encounters a SIM protected by a PIN with the PUK unknown. After how many incorrect PUK entries does the SIM typically become permanently unusable, and what is the implication?

57 An examiner is deciding whether to root an Android device before acquisition. Which statement best captures the forensic trade-off?

58 Regarding iOS device states, why is a device in AFU (After First Unlock) generally more favorable for acquisition than one in BFU (Before First Unlock)?

59 An investigator performs an iOS logical acquisition via an encrypted iTunes/Finder backup. Why can enabling a backup password sometimes yield more forensic data than an unencrypted backup?

60 An examiner considers a chip-off physical acquisition on a modern Android phone with File-Based Encryption (FBE). What is the primary limitation of the raw NAND dump obtained?