CHFI Application, Email and Cloud Forensics Practice Question
An email forensic analyst receives a suspicious email and wants to verify the originating IP address. The analyst extracts the email headers and sees multiple 'Received' fields. Which 'Received' header should the analyst consider as the most trustworthy source of the sender's IP?
⚠ Common exam trap
A common trap in CHFI is to assume headers are chronological from top to bottom, leading candidates to select the first 'Received' header as the origin. In reality, the bottommost header is the earliest hop.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The last 'Received' header at the bottom
The last 'Received' header at the bottom is the most trustworthy because email headers are added in reverse chronological order: each mail server prepends its own 'Received' field to the top of the header block. Therefore, the bottommost 'Received' header represents the first hop from the sender's MTA (Mail Transfer Agent) or the originating client, making it the closest to the true source IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The first 'Received' header at the top
Why it's wrong here
The topmost Received header is the last trace entry added by the recipient's own mail server after final delivery; it records only the immediate previous relay hop, not the sender's network. Because Received fields are prepended in transit, any intermediate server can rewrite or omit earlier entries, and this newest header is relatively easy to influence. Therefore it cannot reliably pinpoint the original source IP.
- ✓
The last 'Received' header at the bottom
Why this is correct
The bottommost Received header is chronologically the first hop recorded, inserted by the sender's first SMTP server or mail user agent at the time of submission. It is the deepest part of the routing chain and provides the closest traceable IP/HELO information to the true origin, making it the best evidence for identifying the actual source. Analysts rely on this header because subsequent servers append above it without altering its content in normal operation.
- ✗
The 'X-Originating-IP' header
Why it's wrong here
X-Originating-IP is an optional, ad-hoc header generated by certain webmail and messaging clients to log the user's public IP at login or submission. It is not governed by SMTP and is not verified or added by message transfer agents, so it can be trivially spoofed or omitted by a sender using direct SMTP. It may serve as an investigative lead, but it is not a trusted trace header for forensic proof of origin.
- ✗
The 'Return-Path' header
Why it's wrong here
Return-Path is inserted by the final delivering MTA to record the RFC 5321 envelope return address (MAIL FROM), used for bounce handling, and says nothing about the transport path. It specifies only an email address or domain, not an IP address, and the envelope sender can be freely forged during the SMTP transaction unless authenticated via SPF or DKIM. Consequently, it cannot identify the originating IP address.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.