QUESTION 3 (20 MARKS) Case Study 1: There are thousands of spam emails sent to your company's employees lately. As a res

[answerhappygod]

Question 3 20 Marks Case Study 1 There Are Thousands Of Spam Emails Sent To Your Company S Employees Lately As A Res 1 (87.77 KiB) Viewed 32 times

QUESTION 3 (20 MARKS) Case Study 1: There are thousands of spam emails sent to your company's employees lately. As a result, you need to investigate an email header received from your IT department depicted in Figure 2. Based on the email header, you need to examine the email message critically. Return-Path: <[email protected]> Received: from smtp.com (fw.emumail.com [215.52.220.122]. by raq-221-181.evl.net (8.10.2/8.10.2. with ESMTP id h78NIN404807 for [email protected]>; Wed, 6 Apr 2022 17:18:50 -0500 Received: (qmail 12685 invoked from network.; 5 Apr 2022 22:25:25 -0000 Received: from ([19.25.19.10]. by smtp.com with SMTP Received: from unknown (HELO MIKELAPTOP. (168.150.84.123. by localhost with SMTP; 5 Apr 2022 22:25:01-0000 From: "Bill Gates" <[email protected]> To: "blacky" <blacky@theOne Stop Solution.com> Subject: We need your help! Date: Tue, 5 Apr 2022 18:12:28 -0400 Message-ID: <51.32.123.21@MIKELAPTOP> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----- Next Part_000_0052_01C35DE1.03202950" X-Priority: 3 (Normal. X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Importance: Normal Figure 2: Email Header Discuss your investigation in detail and list the critical information you will need to determine the IP address involved in this email communication. Your discussion should include the following: a) Main use of email header in the forensic investigation. (2M) b) TWO (2) main steps for examining the email header. (4M) c) Main attributes that involved in this email communication. (5M) d) Originator IP address and the path of the IP address involved in this email communication. (3M) e) Hypothesis based on your findings. (3M) f) Whole scenario of the incident based your findings in this email communication to show the relation of the traces discovered. (3M)