01Session plan
| Minutes | Block | What happens |
|---|---|---|
| 0–10 | Brief and rules | Read the scenario aloud. State the four rules that decide most answers: verify first, work on copies, read the Received lines from the bottom, convert every time to UTC. |
| 10–30 | Integrity and the raw message (Q1, Q5–Q7, Q9) | Hash check first, then the header fields. Count the Received lines and write each one with its server and its time. |
| 30–55 | The path and the recorded results (Q2, Q8, Q10) | Compare message-disputed.eml with message-previous.eml: which hops belong to the supplier, which results pass, and where a reply would go. |
| 55–80 | The export: times, keys and scope (Q3, Q4, Q11–Q13) | Convert the web-view and header times to UTC, match records by Message-ID, then state what the export covers. |
| 80–90 | Debrief | Run the debrief questions. Ask each trainee for one sentence about this message that they would not sign. |
Materials: the pack files on each trainee's machine, a printed worksheet from the pack page, and an examination log form. Pack page →
02Answer key
Q011 point
On a copy of message-disputed.eml, compute the SHA-256 value, compare it with manifest.txt, and enter the first eight hex characters.
Answer45b02031
The prefix matches the manifest line for message-disputed.eml. Integrity is checked before the file is read, so that every later finding can be tied to the bytes that were examined.
- Where
- manifest.txt, the message-disputed.eml line; recompute with sha256sum or another SHA-256 tool.
- Usual mistake
- Hashing a copy that a mail client re-saved, whose bytes then differ from the original.
Hash calculatorF-04 Examination logSOP-02 Evidence intake and registration
Q022 points
Read the Received lines of message-disputed.eml from the bottom up. Which statement about the path is true?
AnswerB — The lowest line records a client at 198.51.100.17 that reached mail-out.lookalike-mail.example. No line passes through the supplier's own server.
Each server writes its own Received line. RFC 5322 section 3.6 says trace fields are kept in blocks prepended to the message, so the lowest line is the first hop the file records. The file has no DKIM-Signature header.
- Where
- message-disputed.eml: the three Received lines, the absence of DKIM-Signature, and the Authentication-Results line.
- Usual mistake
- Reading from the top and taking the newest line, which Heron's own mailbox server wrote, as the origin.
Q032 points
In cloud-export.csv, what is the UTC time of rec-000318, the record that shows the gateway received the message? Enter it as YYYY-MM-DD HH:MM:SS.
Answer2026-03-16 06:20:03
event_time_utc is in UTC. The gateway's Received line for the same message reads 09:20:03 +0300, which is the same instant.
- Where
- cloud-export.csv, row rec-000318; export-metadata.txt, the column rule.
- Usual mistake
- Taking the local time of the web view, or the +0300 of a header, as UTC without converting it.
Q042 points
The web view of the export shows the delivered_to_mailbox record rec-000319 at 09:20:07. What is its UTC time? Enter it as YYYY-MM-DD HH:MM:SS.
Answer2026-03-16 06:20:07
The web view uses local time, UTC+3, so 09:20:07 is 06:20:07 UTC. The column event_time_utc holds the UTC value directly.
- Where
- cloud-export.csv, row rec-000319; export-metadata.txt, the web-view line.
- Usual mistake
- Accepting the web-view value as UTC, which places the delivery three hours late.
Q051 point
How many seconds passed between the Date header of message-disputed.eml and the delivered_to_mailbox record rec-000319? Enter a whole number.
Answer9
The Date header, 09:19:58 +0300, is 06:19:58 UTC. Record rec-000319 is 06:20:07 UTC. The difference is nine seconds. Both values must be in UTC before they are subtracted.
- Where
- message-disputed.eml, the Date line; cloud-export.csv, row rec-000319.
- Usual mistake
- Subtracting the local value of the header from the UTC value of the record, which gives a difference of about three hours.
Q061 point
Which domain did the receiving server's SPF check name in smtp.mailfrom for message-disputed.eml?
Answerlookalike-mail.example
The Authentication-Results line records spf=pass for smtp.mailfrom=lookalike-mail.example. That is the domain the SPF check used. It is not the domain in the From header, and the result describes that domain only.
- Where
- message-disputed.eml, the Authentication-Results line.
- Usual mistake
- Answering with the From domain. SPF and From are checked separately and can name different domains.
Q071 point
Which address does the From header of message-disputed.eml show?
Answeraccounts@cedar-steel.example
The From header shows the supplier's name and address. The display name is written by the sender, so it is not proof of who sent the message. The header is a claim. The path and the recorded results are what the files can test.
- Where
- message-disputed.eml, the From line.
- Usual mistake
- Using the display name or the Reply-To address in place of the From address.
Q082 points
What does the Authentication-Results line of message-disputed.eml record for DMARC, and what does that record not establish?
AnswerB — dmarc=fail for header.from=cedar-steel.example, as recorded by mx.heron-yapi.example. It is the receiving server's recorded result, and by itself it does not show who wrote the message.
RFC 8601 defines Authentication-Results as the record of the checks made by the named authentication service. The first token, mx.heron-yapi.example, names that service. The recorded SPF pass is for lookalike-mail.example, which is not the From domain, and no DKIM signature is recorded, so the recorded DMARC result is fail. The line does not contain the domain's policy record, which is a separate check that this pack does not make.
- Where
- message-disputed.eml, the Authentication-Results line; message-previous.eml, for a result that passes.
- Usual mistake
- Reading the Authentication-Results line as a statement of the sender's identity.
Q091 point
How many Received lines does message-disputed.eml contain? Enter a whole number.
Answer3
There are three Received lines, one written by each server on the path. The lowest was written by mail-out.lookalike-mail.example, the middle by Heron's gateway and the top by Heron's mailbox server. The Return-Path line is a trace field but not a Received line.
- Where
- message-disputed.eml, the lines that begin with Received:.
- Usual mistake
- Counting the Return-Path line, which is a trace field but not a Received line, or counting only the lines that name Heron.
Q102 points
If the accounts clerk pressed Reply, where would the headers of the message direct the reply?
AnswerB — accounts@cedar-steel-finance.example, the Reply-To address.
A Reply-To header names the address that replies should go to. Here it names a different domain from the From address. A reply path that differs from From is a reason to confirm the request through a channel the company already uses. It is not a finding about intent.
- Where
- message-disputed.eml, the Reply-To and From lines.
- Usual mistake
- Assuming that a reply always goes to the From address.
Q112 points
Which field is the strongest key for matching a record of the export to this e-mail?
AnswerB — internet_message_id, matched to the Message-ID header, because RFC 5322 section 3.6.4 says a Message-ID holds a single unique identifier.
Subjects and display names repeat across messages. RFC 5322 section 3.6.4 defines the Message-ID field as holding a single unique identifier, and the export stores that value in internet_message_id. Two rows of the export carry the Message-ID of the disputed message.
- Where
- message-disputed.eml, the Message-ID line; cloud-export.csv, the internet_message_id column.
- Usual mistake
- Matching by subject or by display name, which many messages can share.
Q121 point
Which client address does the export record for rec-000344, the internal forward from the clerk's mailbox?
Answer192.0.2.61
The forward is recorded with client_ip 192.0.2.61, the same address as the clerk's earlier outbound message in rec-000301. In this synthetic pack both stand for the clerk's internal client; the addresses come from the documentation range 192.0.2.0/24 (RFC 5737). The forward is a new message with its own identifier, not the disputed message.
- Where
- cloud-export.csv, row rec-000344, the client_ip column; export-metadata.txt, the column rules.
- Usual mistake
- Reading the forward's Message-ID as the identifier of the disputed message.
Q132 points
Is the export complete for its query window, 2026-03-12 00:00 to 2026-03-17 00:00 UTC (end exclusive)? Choose the statement that is true.
AnswerA — Yes, for this query: six rows were returned, below the 500-row limit, and no next page is listed. The export shows nothing outside this mailbox, outside the window, or in message content.
The metadata states the rows returned (6), the row limit (500) and the next page (none). The window covers all six rows, and the scope line says what the export does not contain. Reading the scope line is part of reading the export correctly. The export started at 12:05:33 UTC on 16 March, before the window ends, so it cannot hold events after that time; 'complete' means complete for what the service held when the export ran.
- Where
- export-metadata.txt: rows returned, row limit, next page and scope lines.
- Usual mistake
- Treating the export as the full history of the mailbox, or as proof that nothing else happened.
03Reconstructed timeline
Saturday 14 March 2026, as the correct answers build it. Local time is UTC+3.
| UTC | Local | Event | Source |
|---|---|---|---|
| 08:03:55 | 11:03:55 | rec-000287: the supplier's earlier invoice is received through mail.cedar-steel.example (203.0.113.10). It is the reference for a normal path. | cloud-export.csv |
| 06:20:03 | 09:20:03 | rec-000318: the gateway receives the disputed message from 203.0.113.80. | cloud-export.csv |
| 06:20:07 | 09:20:07 | rec-000319: the message is delivered to the clerk's mailbox, nine seconds after the Date header in UTC. | cloud-export.csv |
| 06:52:30 | 09:52:30 | rec-000344: an internal forward from the clerk's mailbox, from 192.0.2.61. The export does not show which message it carries. | cloud-export.csv |
04Scoring
Questions 1–11 carry one point each and question 12 carries three: 20 points in all. The finding paragraph is not scored by points; mark it against the four criteria below and discuss it in the debrief.
| Points | Next step |
|---|---|
| 18–20 | Sound. Move on to a supervised review of a real header set, or to VP-02 if you have not done it. |
| 11–17 | Review each missed question with its explanation and its linked records, then derive Q2, Q5 and Q10 again from the files. |
| 0–10 | Work through the mail-header and time-basis modules first, then repeat the pack from the start. |
Finding paragraph: criteria
- ☐ The report lists each Received line with its server and its UTC time, from the bottom up.
- ☐ Every time carries its basis: UTC, or local time with its offset.
- ☐ The report states what the headers record and does not name who sent the message.
- ☐ Each claim names its file and line, and the report states what the export does not cover.
05Debrief
- A From header is written by the sender. It is a claim, and it is not proof of who wrote the message.
- A web view may show local time. Read the column name and the export metadata before you use any time.
- A Message-ID links a record to a message. Subject lines and display names repeat across messages.
- An export proves what its query returned, within its window and its page. It does not prove that nothing else happened.
06Model finding
The disputed message (message-disputed.eml) has three Received lines. The lowest records a client at 198.51.100.17 that reached mail-out.lookalike-mail.example, and no hop passes through the supplier's own server, mail.cedar-steel.example. Its From and Reply-To domains differ. The recorded SPF pass is for lookalike-mail.example, and the recorded DMARC result for cedar-steel.example is fail. The export records receipt by the gateway at 2026-03-16 06:20:03 UTC and delivery to the mailbox at 06:20:07 UTC, nine seconds after the Date header converted to UTC. The export is complete for its query (six rows, no next page) and links to the message through internet_message_id. The pack does not say who sent the message or why. It records what the headers and the export show, and what they cannot show, such as who controlled the sending account.