Computer Hacking Forensic Investigator (CHFI v10) — Question 5

When investigating a potential e-mail crime, what is your first step in the investigation?

Answer options

• A. Trace the IP address to its origin
• B. Write a report
• C. Determine whether a crime was actually committed
• D. Recover the evidence

Correct answer: D

Explanation

The first step in investigating an e-mail crime is to recover the evidence, as this provides the necessary data to understand the situation. Without evidence, tracing the IP address, writing a report, or determining if a crime occurred would be premature actions that lack a solid foundation.