Investigations of email policy violations are generally the same as other computer abuse investigations.

• A. True
• B. Depends
• C. Not Determinable
• D. False

Answer: (D)

Email investigations involve unique evidence sources and privacy considerations that set them apart from other computer abuse cases. While some investigative steps—like preserving evidence, identifying scope, and documenting findings—are common, email policy violations rely on data that resides in mail servers, mailboxes, and related logs, often across multiple systems and retention policies. You must account for privacy concerns, corporate policies, and potential legal holds or e-discovery requirements, which can require special procedures for preserving, collecting, and validating email evidence. Metadata such as routing information, timestamps, and recipient lists can be crucial and may come from servers, backups, or third-party providers, not just the investigator’s local device. Because of these factors, investigations of email policy violations are not conducted in the same way as other computer abuse investigations.