Computer Hacking Forensic Investigator (CHFI v10) — Question 304

In an email crime investigation, the forensic investigator analyses a computer using the Microsoft Outlook application. The investigator knows that Outlook stores email data in both .pst and .ost file formats. They want to focus on the files that hold the email data even when there is no internet connection. Which files should the investigator target for a deeper analysis?

Answer options

• A. Offline Storage Table (.ost) files located at C:\Users\%USERNAME%\AppData\Local\Microsoft\Outlook
• B. Email data located within Mozilla Thunderbird and Apple Mail email clients
• C. Archived email files in .pst format located via File —> Options —> Advanced —> AutoArchive Settings
• D. Personal Storage Table (.pst) files located at C:\Users\%USERNAME%\Documents\Outlook Files

Correct answer: A

Explanation

The correct answer is A because .ost files are specifically designed to store data for offline access in Microsoft Outlook, allowing users to access their emails without an internet connection. Options B and C do not pertain to Outlook's storage mechanisms, while option D, although it pertains to .pst files, does not provide offline access in the same way as .ost files do.