D. Smith, a contract employee of computer services at the reputed organization intentionally downloaded a zipped file called 'ZIP-78' from the Internet Aware of the consequences, he sent the 'ZIP-78' file to an e-mail account on the company's e-mail server, on at least seven different occasions His action not only shuts down the email server but incurred heavy losses in bringing the e-mail server back to production.

1. In the above scenario, what are the possible reason for shut down of server when Smith send email to company email server?
2. As a forensic investigator how do you investigate the above scenario, highlights the potential source of evidence in the given scenario. List out all the tools that can be used for examination and analysis of evidence obtained from above scenarios.
3. Discuss recommendations for preventing such an attack in the future.