From the official EC Council courseware - step 1 is recover the evidence. Seize the email accounts, acquire the email data, examine the messages and then the headers.
The question is unclear as to what stage of the process the investigation is at. At the very beginning of an email investigation, wouldn't you want to retrieve the email in question?
I agree with JDKirk, if it's a "potential" crime and this is the first step, why would we start tracing IP addresses and how could we trace IP addresses if we didn't first recover the evidence?
...maybe the word, "recover" excludes D as the best choice since it means specifically that something was hidden or destroyed which isn't necessarily the case within this context so the next best answer is tracing the IP address?
upvoted 2 times
...
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
4bd3116
3 months, 4 weeks agoDumas
5 months agoDumas
5 months agoElb
5 months, 3 weeks agovcloudpmp
2 years, 8 months agoK3nz0420
2 years, 8 months agoJDKirk
3 years agoAspiringScriptKiddie
2 years, 9 months ago