When investigating a potential e-mail crime, what is your first step in the investigation?

The correct answer is A. Trace the IP address to its origin. In email crime investigations, the first technical step is analyzing the email headers to extract and trace the originating IP address. Email headers contain a chain of 'Received:' entries that record each server the message passed through, including the sender's originating…

Submitted by miguelv· Apr 18, 2026Computer Forensics Investigation Process

Question

Options

ATrace the IP address to its origin
BWrite a report
CDetermine whether a crime was actually committed
DRecover the evidence

How the community answered

(30 responses)

A
93% (28)
C
3% (1)
D
3% (1)

Explanation

In email crime investigations, the first technical step is analyzing the email headers to extract and trace the originating IP address. Email headers contain a chain of 'Received:' entries that record each server the message passed through, including the sender's originating IP. Establishing origin is foundational: it identifies the source jurisdiction, potential suspects, and whether the email is authentic or spoofed. This information must be gathered before writing reports, recovering additional evidence, or confirming the legal nature of the act, because without origin data there is little to investigate.

Topics

#Email Forensics#Investigation Steps#IP Tracing#Digital Forensics Process

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice