Question $4$

While performing computer forensics investigation on emails, the investigator can get evidence not only from the body of the email, but also from its header.

$($a$)$ Describe THREE $(3)$ different types of evidence that can be extracted from email header and provide ONE $(1)$ example for each.

$[6$ marks$]$

$($b$)$ As a digital forensic investigator, highlight ONE $(1)$ difference when working with resident email files and webmail.

$[4$ marks$]$