Lab 7 Assessment Worksheet

Automating Email Evidence Discovery

Lab Assessment Questions

1. What was the content of the chat message between badguy11111 and badguy22222?

2. What program was identified by E3 as the chat software used by badguy11111?

3. Explain how MD5 and SHA1 hash codes generated by E3 helps maintain the chain of evidence in a digital forensic investigation.

4. What was the e-mail application used by badguy11111 on the evidence hard drive under investigation?

5. What is the importance of the e-mail header to a forensic investigation?

6. How many attachments were included in the e-mails from badguy11111s evidence drive? What were the names of the files?