ACFE - Association of Certified Fraud Examiners Digital Forensics and Evidence Questions and Answers

Question 1

A Certified Fraud Examiner arrives to seize a computer that is currently powered on and is suspected of containing evidence of an ongoing data exfiltration scheme.
To ensure that crucial, time-sensitive evidence is not lost, which of the following actions should be performed FIRST?

Accepted Answer

Perform a live acquisition to capture the contents of RAM.

Answer

Create a bit-stream image of the hard drive.

Answer

Disconnect the computer from the network to stop the data exfiltration.

Answer

Photograph the screen and all physical connections to the computer.

Question 2

In digital forensics, what is the primary purpose of creating a cryptographic hash (e.g., MD5 or SHA-256) of a digital evidence file immediately after acquisition?

Accepted Answer

To verify the integrity of the evidence and prove it has not been altered. [6, 8]

Answer

To compress the file for efficient long-term storage.

Answer

To create a searchable index of the file's contents.

Answer

To encrypt the evidence to prevent unauthorized access.

Question 3

Which of the following is the MOST critical component for maintaining the chain of custody for a piece of digital evidence to ensure its admissibility in court?

Accepted Answer

A detailed, chronological log documenting everyone who handled the evidence, when they handled it, and for what purpose. [2, 16]

Answer

Storing the evidence in a climate-controlled, secure facility.

Answer

Making multiple backup copies of the evidence on different media types.

Answer

Using only court-approved forensic software for the analysis.

Question 4

A fraud examiner needs to analyze an employee's hard drive for evidence, including files the employee may have recently deleted. Which data acquisition method is MOST appropriate for this task?

Accepted Answer

Creating a bit-stream image of the entire hard drive.

Answer

A logical acquisition that copies only the user's document folders.

Answer

A targeted file copy of all files with relevant extensions (e.g., .docx, .xlsx).

Answer

Backing up the drive using the operating system's standard backup utility.

Question 5

When examining a suspicious electronic document, a fraud examiner analyzes its metadata. Which of the following pieces of information is an example of what could be found in the file's metadata?

Accepted Answer

The dates the file was created and last modified. [31, 35]

Answer

A complete history of all text that was ever deleted from the document.

Answer

The IP address of every computer that has ever accessed the file.

Answer

A recording of the keystrokes used to create the document's content.

Question 6

An investigator suspects an employee is smuggling proprietary data out of the company by hiding it within large, seemingly innocuous image files that are emailed to a personal account. This technique of concealing data within another file is known as:

Accepted Answer

Steganography

Answer

Encryption

Answer

Hashing

Answer

Compression