Legal Compliance in Computer Forensics DFE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of a forensic investigator's final report?

   • ATo document the findings and the methods used in a clear and understandable manner for legal and administrative purposes
   • BTo serve as a backup of the forensic image
   • CTo provide a detailed list of all software used during the investigation
   • DTo satisfy the investigator's personal record-keeping needs
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a forensic examination, an investigator accidentally opens a file that contains privileged attorney-client communication. What is the most appropriate action?

   • AStop examining the file, document the access, and notify the legal team.
   • BContinue examining the file because it may contain relevant evidence.
   • CInclude the content in the report without mentioning the access.
   • DDelete the file to avoid any legal issues.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   During a forensic examination, the investigator discovers that the original evidence was accidentally modified by a technician before the forensic image was taken. The modification was minor and documented. What is the most appropriate course of action to maintain admissibility?

   • AClaim the modification did not happen.
   • BDiscard the evidence and start over.
   • CHide the modification to avoid disqualifying the evidence.
   • DDocument the modification thoroughly and explain its impact on the analysis.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A forensic investigator is working on a case that involves data stored on a server in a foreign country. The investigator needs to access that data to complete the analysis. The investigator's home country has a mutual legal assistance treaty (MLAT) with the foreign country. What is the most appropriate legal step for the investigator to take?

   • AAsk the foreign company's IT administrator to copy the data and send it directly to the investigator.
   • BAccess the server remotely using credentials obtained from the investigation, as the MLAT is only a formality.
   • CIgnore the foreign data and base the investigation only on local evidence.
   • DRequest the data through the official MLAT process, which provides a legal framework for cross-border evidence gathering.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An investigator is documenting the chain of custody for a mobile phone seized at a crime scene. Which of the following is the most critical piece of information to record?

   • AThe phone's wallpaper image.
   • BThe phone's battery level.
   • CThe phone's color and model.
   • DThe phone's IMEI number and physical condition.
   Reveal Solution Discussion Select an answer first