CHFI Application, Email and Cloud Forensics Practice Question
In email forensics, which artifact is stored in Outlook's Personal Folders (.pst) files and can be analyzed using tools like Aid4Mail or EmailTracker?
⚠ Common exam trap
The CHFI exam often tests the misconception that .pst files only store emails and attachments, when in fact they are a full mailbox container that includes calendars, contacts, tasks, and other items.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Emails, attachments, calendars, contacts, and other mailbox items
Outlook Personal Folders (.pst) files are not limited to storing just email content; they are a comprehensive container for multiple mailbox items. In addition to emails and attachments, .pst files store calendars, contacts, tasks, notes, journal entries, and other mailbox artifacts. Tools like Aid4Mail and EmailTracker can parse the entire .pst structure to extract and analyze all these item types, making option D correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only the email body text
Why it's wrong here
A .pst file is a structured Personal Storage Table that archives complete MAPI message objects. Limiting it to only the email body text ignores the transport headers, MIME encoding, attachment parts, sent/received timestamps, and custom properties that examiners routinely parse. The body is merely one element of the message's property set, so this option incorrectly narrows the evidence scope.
- ✗
Emails and attachments only
Why it's wrong here
While emails and their attachments are prominent, Outlook's .pst is not restricted to those item types; it also stores calendar appointments, contacts, tasks, journal entries, notes, and even rules. The folder hierarchy and item structure are stored as distinct MAPI objects, meaning forensic recovery must account for every item class. Thus this option understates the archive's range.
- ✗
Email headers only
Why it's wrong here
Email headers alone cannot be a .pst artifact because the format retains the full RFC 822/MIME message content, including the body, attachments, and all custom MAPI properties. Headers are only a substring of the message properties, useful for tracing routing, but the .pst preserves the complete item. This option mistakes a metadata fragment for the entire stored object.
- ✓
Emails, attachments, calendars, contacts, and other mailbox items
Why this is correct
A .pst is a comprehensive personal folders backup that stores an entire mailbox tree: email items with attachments, calendar entries, contacts, tasks, notes, and journal records, all as structured MAPI objects. This breadth is what makes it invaluable in investigations, as deleted or orphaned items may remain in free-space blocks or the folder hierarchy. Therefore the correct characterization is a full mailbox archive, not a subset.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.