Legal Compliance in Computer Forensics DFE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A forensic investigator is handling a case that involves data from a cloud service provider. The provider is located in a different country, and the data may be subject to both the provider's terms of service and local privacy laws. The investigator needs to obtain the data for a criminal investigation. What is the most appropriate first step?

   • AAsk the cloud provider for the data informally via email.
   • BUse a formal legal process, such as a mutual legal assistance treaty (MLAT) or a court order.
   • CHack into the cloud provider's servers to obtain the data.
   • DAssume the data is not protected because it is in the cloud.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A forensic investigator in the European Union is handling a case that involves personal data of EU citizens. The investigator needs to transfer the data to a server located in a country that does not have an adequacy decision from the EU. What should the investigator do to ensure compliance with the GDPR?

   • ATransfer the data anyway because the investigation is a law enforcement matter and GDPR does not apply.
   • BStore the data only on servers within the EU and do not transfer it at all.
   • CUse standard contractual clauses (SCCs) approved by the EU to provide appropriate safeguards for the transfer.
   • DAnonymize the data before transfer, so GDPR no longer applies.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A forensic examiner is documenting the chain of custody for a mobile phone. The examiner seizes the phone, places it in a Faraday bag, and logs it into evidence. The phone is then transported to a lab. At the lab, the examiner opens the Faraday bag to begin the examination, but forgets to document the time the bag was opened. Later, the defense argues that the phone could have been remotely wiped during the unlogged period. What is the most effective way to counter this argument?

   • AArgue that the Faraday bag is tamper-evident and therefore the phone could not have been accessed.
   • BState that the examiner's personal notes confirm the phone was not accessed, even though the log is incomplete.
   • CClaim that the phone's data was hashed before the examination, so any remote wipe would be detected.
   • DDocument the exact time the Faraday bag was opened and the phone was examined, and explain the procedures used to prevent remote access.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which regulation imposes strict requirements on the processing of personal data, including the right to erasure, and can impact how digital evidence containing personal data is handled in the European Union?

   • AThe Payment Card Industry Data Security Standard (PCI DSS)
   • BThe General Data Protection Regulation (GDPR)
   • CThe Sarbanes-Oxley Act (SOX)
   • DThe Health Insurance Portability and Accountability Act (HIPAA)
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During a forensic examination, an investigator uses a tool that is not widely accepted in the forensic community. The tool produces a report, but the investigator cannot explain how the tool works internally. The defense argues that the evidence should be excluded because the tool is unreliable. Which factor is most likely to determine whether the evidence is admitted?

   • AWhether the tool is commercially available and has a user interface.
   • BWhether the investigator had a valid search warrant for the device.
   • CWhether the tool's methodology is generally accepted in the relevant scientific community and the results can be validated.
   • DWhether the investigator's report is written in a clear and understandable language.
   Reveal Solution Discussion Select an answer first