Digital Forensic Certification Practice Exam

Which email header field indicates the date and time an email was sent?

1. Message ID

2. Timestamp

3. MIME

4. Sender Address

The correct answer is: Timestamp

The header field that indicates the date and time an email was sent is the "Timestamp." This field records the exact moment the email was dispatched from the sender's mail server. It is a critical piece of information in digital forensics, as it helps establish the timeline of events related to the email exchange. Understanding when an email was sent can be vital for investigations involving communication, especially when determining the chronology of actions or establishing the timing of responses. Other fields like Message ID, MIME, and Sender Address serve different purposes. The Message ID is a unique identifier for each email that helps track its travel through multiple servers but does not provide timing information. MIME is related to the format and encoding of the email content, allowing it to support attachments and various text types, but again, it does not give temporal information. The Sender Address indicates who sent the email but does not provide any details on when it was sent. Thus, the timestamp is specifically designated for recording the sending date and time of the email.