Legal Compliance in Computer Forensics DFE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A forensic investigator is examining a computer that belongs to a company. The company's IT policy states that employees have no expectation of privacy on company devices. The investigator finds personal files that are unrelated to the case. What is the investigator's ethical and legal obligation regarding those unrelated personal files?

   • ADelete the personal files to protect the employee's privacy.
   • BInclude all personal files in the report because they are on a company device and therefore fair game.
   • CCopy the personal files to a separate drive and give them to the company's HR department.
   • DDocument the files' existence but do not include them in the report unless they are relevant to the case.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A forensic examiner is documenting the chain of custody for a hard drive seized from a crime scene. The examiner records the date, time, and location of the seizure, and then places the drive in a sealed evidence bag. The examiner signs the bag and stores it in a secure evidence room. Later, the examiner needs to transfer the drive to a lab for analysis. What is the most important step to maintain the chain of custody during the transfer?

   • ACall the lab to confirm receipt, and note it in the examiner's personal notes.
   • BEmail the lab a photo of the drive and the evidence bag.
   • CCreate a transfer log that documents the date, time, and signatures of both the releasing and receiving parties.
   • DSend the drive via a courier service that provides a tracking number.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A forensic examiner seizes a USB drive from a suspect's desk. The examiner labels the drive with a unique evidence number, photographs it, and places it in a locked evidence locker. The examiner then goes to lunch. When the examiner returns, the locker is unlocked and the drive is missing. Later, the drive is found on a nearby table. The examiner resumes the examination without documenting the incident. What is the most critical legal consequence of this omission?

   • AThe evidence is automatically considered tampered with and cannot be used in any legal proceeding.
   • BThe evidence may be ruled inadmissible because the chain of custody has a gap that cannot be explained.
   • CThe examiner must report the incident to the police, but the evidence can still be used if the examiner testifies about the incident.
   • DThe examiner will be personally liable for civil damages for losing the evidence.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A forensic team is investigating a cross-border fraud case. The data is stored on a cloud server located in a country with strict data protection laws, but the company is headquartered in a country with different legal requirements. The team has obtained a court order in the headquarters' country, but the cloud provider refuses to release the data without a court order from the data's location. The team is under time pressure to complete the investigation. What is the most legally sound course of action?

   • AAsk the cloud provider's legal team to voluntarily release the data, citing the urgency of the investigation.
   • BAccess the data through a backdoor or administrative credentials to bypass the provider's refusal.
   • CUse the headquarters' court order to compel the cloud provider to release the data, citing the company's headquarters jurisdiction.
   • DPursue a mutual legal assistance treaty (MLAT) request to obtain a court order in the data's location.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Before conducting a forensic acquisition of a computer, what is the primary legal obligation of a forensic investigator?

   • ACreate a forensic image of the hard drive
   • BInstall monitoring software on the target system
   • CNotify the system administrator of the investigation
   • DObtain proper authorization, such as a search warrant or consent
   Reveal Solution Discussion Select an answer first