Legal Compliance in Computer Forensics DFE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A forensic team is investigating a ransomware attack that encrypted a hospital's patient records. The attack may have exfiltrated personal health information (PHI). The hospital is subject to HIPAA and the GDPR because it treats EU patients. The team has identified the scope of the breach. What is the most critical compliance obligation the team must address?

   • ANotify only the affected patients, as they are the most directly impacted.
   • BNotify both the relevant health authority (e.g., HHS) and the data protection authority (e.g., EU DPA) within the required timeframes.
   • CWait until the forensic investigation is complete to ensure the notification is accurate.
   • DNotify only the hospital's legal counsel and insurance provider, as they are the primary stakeholders.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A forensic examiner is analyzing a hard drive that was imaged using a tool that does not compute a hash of the image. The examiner later realizes that the tool did not create a hash, but the image was made with a write blocker. The defense challenges the evidence's integrity. The examiner has the original drive and the image. What is the best way to address the integrity challenge?

   • AUse the original drive as evidence and discard the image, since the image lacks a hash.
   • BTestify that the write blocker ensures the drive was not altered, so the evidence is reliable.
   • CReacquire the image using a tool that computes a hash, and compare the new hash to the original drive's hash.
   • DCompute a hash of the existing image and the original drive, and document that they match.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A forensic investigator is working on a case that involves a company's internal investigation. The company is headquartered in a country with strict data protection laws, but the data is stored in a country with less strict laws. The investigator is asked to analyze the data locally in the country where it is stored. What is the most important legal consideration?

   • ANo laws apply because it is an internal investigation.
   • BThe company's internal policies are the only rules that apply.
   • CThe laws of the storage country always apply exclusively.
   • DThe data protection laws of the company's home country may apply extraterritorially to the data.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A forensic examiner is testifying in court about a forensic image. The examiner used a tool that is widely accepted, but the examiner did not verify the hash of the image after acquisition. The defense argues that the image may not be an accurate copy. The examiner has the original drive and the image. What is the best way for the examiner to respond?

   • AAcknowledge the missing hash, but state that the image can be verified by comparing it to the original drive now.
   • BState that the image is admissible because the tool is generally accepted and the examiner followed standard procedures.
   • CAdmit that the image is not reliable and request a re-acquisition.
   • DExplain that the tool is widely accepted and that the write blocker was used, so the image is reliable.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During a forensic examination, an investigator needs to transfer a seized hard drive from the evidence room to a lab. The evidence log shows the drive was checked out by the investigator and returned two hours later. What is the most important missing element in this chain of custody?

   • AA documented transfer of custody to the lab personnel and back.
   • BA record of who else had access to the evidence room during that time.
   • CA description of the drive's condition upon return.
   • DA hash of the drive before and after the transfer.
   Reveal Solution Discussion Select an answer first