ACFE Digital Forensics and Evidence 5 — Questions and Answers
Question 1: Which standard framework governs the admissibility of scientific or technical expert testimony in US federal courts, relevant to digital forensics experts?
- Frye standard
- Daubert standard (Correct answer)
- Federal Rules of Evidence Rule 404(b)
- Kumho standard exclusively
Correct answer: Daubert standard
The Daubert standard (from Daubert v. Merrell Dow Pharmaceuticals) requires judges to evaluate whether expert methodology is scientifically valid and reliably applied.
Question 2: A fraud examiner is investigating cryptocurrency transactions. What tool or resource is most useful for tracing Bitcoin wallet-to-wallet transfers?
- WHOIS domain lookup services
- Public blockchain explorers like blockchain.com combined with chain analysis software (Correct answer)
- Social media OSINT tools
- Traditional bank wire transfer records
Correct answer: Public blockchain explorers like blockchain.com combined with chain analysis software
Bitcoin's public blockchain records all transactions permanently; blockchain explorers and chain analysis tools (e.g., Chainalysis) trace fund flows between pseudonymous wallets.
Question 3: What does 'order of volatility' dictate in a digital forensics investigation?
- The sequence in which suspects should be interviewed
- The priority order for collecting evidence, from most to least transient (Correct answer)
- The ranking of evidence by its admissibility in court
- The sequence for cataloging physical documents
Correct answer: The priority order for collecting evidence, from most to least transient
Order of volatility (per RFC 3227) guides examiners to collect most volatile data first (RAM, CPU cache) before collecting less volatile data (hard drives, backups).
Question 4: During a fraud investigation, an examiner discovers a suspect used TOR (The Onion Router). What limitation does TOR use present for investigators?
- TOR is illegal to use, making prosecution straightforward
- TOR encrypts and routes traffic through multiple relays, masking the user's true IP address (Correct answer)
- TOR creates permanent log files accessible to law enforcement
- TOR only works on mobile devices, limiting its use
Correct answer: TOR encrypts and routes traffic through multiple relays, masking the user's true IP address
TOR anonymizes internet traffic by routing it through a series of encrypted relay nodes, making it extremely difficult to trace the originating IP address.
Question 5: What is 'data carving' in the context of digital forensics?
- Physically dismantling a hard drive to access platters
- Recovering files from unallocated space based on file signatures without relying on file system metadata (Correct answer)
- Extracting encrypted data using brute-force key recovery
- Removing irrelevant files from an evidence image to reduce its size
Correct answer: Recovering files from unallocated space based on file signatures without relying on file system metadata
Data carving identifies file headers and footers (magic bytes) in raw storage to reconstruct files even when directory entries have been deleted.
Question 6: An employee suspected of embezzlement used a personal Gmail account on a corporate laptop. Which artifact on the laptop is most likely to contain evidence of those webmail sessions?
- The Windows registry's HKLM\SAM hive
- Browser cache, cookies, and IndexedDB/Local Storage files (Correct answer)
- The laptop's BIOS event log
- The corporate VPN configuration files
Correct answer: Browser cache, cookies, and IndexedDB/Local Storage files
Web browsers cache page content, store authentication cookies, and maintain local databases that can contain session tokens, message fragments, and attachment filenames from webmail use.
Question 7: Under the Federal Rules of Evidence, electronically stored information (ESI) is generally treated as which type of evidence?
- Hearsay that is inadmissible without exception
- A business record automatically admissible without authentication
- Documentary evidence subject to authentication and best evidence requirements (Correct answer)
- Circumstantial evidence inadmissible in civil proceedings
Correct answer: Documentary evidence subject to authentication and best evidence requirements
ESI is treated as documentary evidence under FRE 901 (authentication) and FRE 1001-1008 (best evidence rule), requiring the proponent to show it is what it purports to be.
ACFE Digital Forensics and Evidence 5
Which standard framework governs the admissibility of scientific or technical expert testimony in US federal courts, relevant to digital forensics experts?