3. Consider a local area network, attached to the Internet, with email capabilities provided to LAN users. What are some of the capabilities already built in to these systems that might aid the investigator? How might you put those to use? Would that be a live acquisition, or a postmortem one?

4. What sort of information is in an email header, which might pertain to a forensics investigation? How could an investigator determine whether the information in the header has been tampered with? What about the contents of email messages themselves? How would you find these, and extract them as potential evidence?


5. What are the many different kinds of addresses you might need to identify in a network or email-based investigation, and how would you go about correlating events in the incident with these addresses and with the people responsible for them or affected by them?