Investigations involving email are different from other computer abuse investigations.

• A. True
• B. Not Determinable
• C. Depends on jurisdiction
• D. False

Answer: (D)

Digital forensics uses a consistent investigative workflow across different types of digital evidence. The same steps apply: preserve what you find, collect data without altering it, analyze the artifacts, document everything, and report your findings while maintaining a solid chain of custody. Investigations involving email fit into this same framework; you just look for email-specific artifacts—headers, routing paths, mailbox stores, server logs, and attachments—within that same process. The approach isn’t fundamentally different because you’re dealing with email; it’s the particular artifacts and sources that differ. Jurisdiction can affect legal procedures or access rules, but it doesn’t change the underlying methodology.