Legal Compliance in Computer Forensics DFE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a critical element that must be recorded in a chain of custody log for digital evidence?

   • AThe date and time of each transfer of custody
   • BThe IP address of the forensic workstation used
   • CThe hash value of the evidence after analysis
   • DThe brand and model of the storage device
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A forensic investigator is asked to examine a laptop that belongs to a company's CEO. The company's legal counsel has provided a written authorization, but the CEO is a citizen of a country with strict privacy laws. The laptop contains both business and personal files. The investigator is concerned about violating the CEO's privacy rights. What is the most appropriate course of action?

   • ARefuse to examine the laptop until the CEO provides personal consent.
   • BCopy the entire hard drive and give a copy to the CEO's personal attorney to ensure transparency.
   • CProceed with the examination, but limit the scope to business-related files and document the authorization and the scope in the report.
   • DExamine all files, including personal ones, because the authorization covers the entire laptop.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A forensic investigator is called to preserve evidence from a laptop involved in an internal fraud investigation. The investigator takes a forensic image, calculates a hash, and stores the original laptop in a locked evidence locker. Which additional action is most critical to ensure the evidence remains admissible in court?

   • AEncrypt the forensic image with a strong algorithm before analysis.
   • BRun a malware scan on the original laptop before imaging.
   • CMake a second copy of the image and store it offsite for redundancy.
   • DDocument every person who handled the evidence and when, with signatures and timestamps.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A forensic investigator is required to report findings to law enforcement as part of a criminal investigation. What is the most important step before sharing the forensic report?

   • AVerify that the report contains only facts and conclusions supported by the evidence.
   • BDelay the report until the investigation is complete.
   • CRemove all hash values to simplify the report.
   • DShare the raw forensic image with law enforcement instead of the report.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A forensic investigator is processing a computer that contains personal data of customers. The investigation is for a civil lawsuit. What is the most appropriate way to handle the personal data?

   • ALimit access to the personal data to only what is relevant to the case.
   • BShare the data with any interested party.
   • CPublish the personal data to a public forum to be transparent.
   • DIgnore privacy laws because it is a civil case.
   Reveal Solution Discussion Select an answer first