Discuss EC-Council ECSS Exam Topic 4 Question 97

Below are the various steps involved in an email crime investigation.

1.Acquiring the email data

2.Analyzing email headers

3.Examining email messages

4.Recovering deleted email messages

5.Seizing the computer and email accounts

6.Retrieving email headers

What is the correct sequence of steps involved in the investigation of an email crime?

A5->l->3->6-->2 >4

B2->4->3-->6->5-->l

C1--->3->4--->2-->5'>6

D5 -> 1 -> 6 -> 2 -> 3 -> 4

Suggested Answer: D

Seizing the computer and email accounts (Step 5): This is the initial step to secure potential evidence. It involves physically or remotely seizing the suspect's computer and email accounts to prevent tampering.

Acquiring the email data (Step 1): After seizing the devices, investigators acquire the email data. This includes collecting email files, attachments, and metadata.

Retrieving email headers (Step 6): Email headers contain valuable information such as sender IP addresses, timestamps, and routing details. Retrieving headers helps trace the email's origin.

Analyzing email headers (Step 2): Investigators analyze the headers to identify any anomalies, spoofing, or suspicious patterns.

Examining email messages (Step 3): Investigators review the actual email content, attachments, and any embedded links. This step helps understand the context and intent.

Recovering deleted email messages (Step 4): Deleted emails may contain critical evidence. Investigators use specialized tools to recover deleted messages.

EC-Council Certified Security Specialist (E|CSS) documents and study guide.

EC-Council Certified Security Specialist (E|CSS) course materials123

Get Premium ECSS Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

39 comments · newest first

Hillary 11 months ago

Really? I’m surprised that seizing accounts is so early in the process!

Tequila 11 months ago

I agree with Moira, the sequence makes sense to me.

Cristal 11 months ago

Wait, recovering deleted emails before analyzing? That seems off.

Charlette 12 months ago

I think analyzing headers should come right after acquiring data.

Moira 12 months ago

Step 1 is definitely acquiring the email data first!

Edna 1 year ago

I believe seizing the computer is crucial, but I can't recall if it should happen before or after retrieving the email headers.

William 1 year ago

I’m a bit confused about whether we should recover deleted emails before or after analyzing the headers.

Kasandra 1 year ago

I remember practicing a similar question, and I feel like analyzing the headers comes before examining the messages.

Yan 1 year ago

I think the first step should definitely be acquiring the email data, but I'm not sure about the order after that.

Jerlene 1 year ago

This is a good test of our understanding of email crime investigation procedures. I'll methodically go through each step and option to determine the correct sequence.

Oneida 1 year ago

The sequence of steps seems straightforward, but I want to double-check my work before submitting the answer. I don't want to make any silly mistakes on this exam.

Venita 1 year ago

Okay, I think I've got it. The key is to start with seizing the computer and email accounts, then work through the other steps in a logical order. I'm feeling pretty confident about this one.

Gretchen 1 year ago

Hmm, I'm a bit confused by the order of the steps. I'll need to re-read the question and options a few times to make sure I understand the right sequence.

Odette 1 year ago

This looks like a tricky question. I'll need to carefully review the steps and think through the logical sequence.

Ellsworth 2 years ago

Wait, wait, wait... do we really need to seize the computer? Can't we just hack into it from our phones and call it a day? Oh, wait, that's probably not legal. My bad.

Mira 2 years ago

Hmm, this is a tricky one. I'm gonna go with B) 2->4->3-->6->5-->l. After all, what's an email investigation without a little bit of recovering deleted emails?

Nohemi 2 years ago

↳ replying to Mira

I agree, those steps are definitely important. But I think the correct sequence is actually D) 5 -> 1 -> 6 -> 2 -> 3 -> 4. Seizing the computer and email accounts should come before analyzing email headers.

Ollie 2 years ago

↳ replying to Mira

I think you're on the right track with B) 2->4->3-->6->5-->1. Analyzing email headers and recovering deleted emails are crucial steps in the investigation.

Vi 2 years ago

I'm pretty sure the correct sequence is 5 -> 1 -> 6 -> 2 -> 3 -> 4. But hey, who needs evidence when you've got a hunch, am I right?

Lorrie 2 years ago

↳ replying to Vi

I agree with you, it should be 5 -> 1 -> 6 -> 2 -> 3 -> 4.

Aliza 2 years ago

↳ replying to Vi

I'm not sure, but I think it might be 1 -> 3 -> 4 -> 2 -> 5 -> 6.

Rolande 2 years ago

↳ replying to Vi

I believe it's actually 2 -> 4 -> 3 -> 6 -> 5 -> 1.

Rickie 2 years ago

↳ replying to Vi

I think the correct sequence is 5 -> 1 -> 6 -> 2 -> 3 -> 4.

Francine 2 years ago

I'm not sure, but I think C) 1--->3->4--->2-->5-->6 could also be a possible sequence.

Kent 2 years ago

I agree with Marge, D) seems to be the most logical sequence for an email crime investigation.

Olene 2 years ago

Let's see, you gotta seize the computer first, then dig through the headers, and finally recover those sneaky deleted messages. Sounds like a classic detective novel in the making!

Lavera 2 years ago

↳ replying to Olene

Sounds like a detective novel!

Margarett 2 years ago

↳ replying to Olene

Finally, recover the deleted messages.

Marget 2 years ago

↳ replying to Olene

Then analyze the email headers.

Titus 2 years ago

↳ replying to Olene

Seize the computer first.

Derick 2 years ago

↳ replying to Olene

C) 1--->3->4--->2-->5-->6

Zack 2 years ago

↳ replying to Olene

B) 2->4->3-->6->5-->l

Willow 2 years ago

↳ replying to Olene

A) 5->l->3->6-->2 >4

Selma 2 years ago

Ah, the old email crime investigation shuffle! Gotta make sure you get all the steps in the right order, or the whole case falls apart like a house of digital cards.

Octavio 2 years ago

↳ replying to Selma

And don't forget to recover any deleted email messages for additional clues.

Shakira 2 years ago

↳ replying to Selma

Exactly, then you can analyze the email headers and messages to gather evidence.

Lezlie 2 years ago

↳ replying to Selma

That makes sense, you need to seize the computer and email accounts early on in the investigation.

Chantell 2 years ago

↳ replying to Selma

I think the correct sequence is D) 5 -> 1 -> 6 -> 2 -> 3 -> 4

Marge 2 years ago

I think the correct sequence is D) 5 -> 1 -> 6 -> 2 -> 3 -> 4.

EC-Council ECSS Exam - Topic 4 Question 97 Discussion