ACI Cheat Sheet 2026

The 30 highest-yield ACI facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which of the following BEST describes a 'threat actor' in the context of digital forensic risk assessment? → An individual or group with the capability and intent to cause harm
2. In ISO/IEC 17025 compliance for forensic labs, what does the term 'measurement uncertainty' refer to? → A quantified range within which the true value of a measurement is expected to lie
3. An organization's risk appetite statement declares they will accept no more than a 5% probability of a data breach per year. This statement PRIMARILY guides: → Decision-making about which risks to mitigate versus accept
4. Which scenario represents an appropriate use of a forensic investigator's access to a subject's personal data? → Using the data solely for the purposes authorized in the scope agreement
5. Which scenario would require a accessdata certified investigator professional to escalate a accessdata investigator cybercrime investigation techniques concern? → Creating feedback mechanisms that encourage continuous improvement
6. Which SQLite database on an iPhone stores both SMS and iMessage communications? → sms.db
7. A corporate investigator discovers that company executives are directing them to exclude exculpatory evidence from the report. What should the investigator do? → Refuse, include all material evidence, and consider withdrawing from the engagement
8. During a risk management & mitigation audit, which documentation is most critical to have readily available? → Conducting root cause analysis to identify underlying systemic issues
9. The principle of 'non-repudiation' in digital forensics ethics primarily ensures that: → An investigator's actions and findings are attributable and verifiable to them
10. In a quality-compliant forensic lab, who is ultimately responsible for ensuring that all quality standards and accreditation requirements are met? → The laboratory director or quality manager
11. What is the forensic significance of a 'deleted' flag in a SQLite database found on a mobile device? → The record is marked for deletion but the data may still be fully recoverable
12. Which accreditation standard is specifically designed for forensic science laboratories and is commonly required by law enforcement agencies? → ASCLD/LAB (now ANAB)
13. What is the primary objective of quality assurance & compliance within the ACI professional framework? → Analyzing data systematically using validated assessment tools
14. In a corporate forensic investigation, what forensic value can Mobile Device Management (MDM) system records provide? → They contain device activity logs, app install records, and policy compliance history
15. A new regulation impacts accessdata investigator data recovery & file evaluation procedures. What should a ACI professional do first? → Ensuring compliance with current regulatory requirements and standards
16. Why is maintaining the chain of custody critical in forensic investigations? → To ensure digital evidence remains admissible
17. During an investigation, a stakeholder offers the investigator an incentive to expedite the case and produce a particular outcome. The investigator must: → Decline, document the offer, and report it to legal counsel or ethics oversight
18. Which forensic tool is commonly used in cybercrime investigations? → EnCase
19. In forensic investigations, maintaining a strict chain of custody is a risk mitigation practice primarily designed to prevent: → Evidence being ruled inadmissible in court
20. Which type of records can investigators subpoena from cellular carriers to establish a mobile device's historical location and communication activity? → Call Detail Records (CDRs) from cellular carriers
21. An investigator finds child exploitation material while conducting a corporate fraud examination. What is the mandatory ethical and legal obligation? → Report it immediately to law enforcement per mandatory reporting laws
22. During a network intrusion investigation, what is the significance of identifying a 'beaconing' pattern in firewall logs? → It suggests malware is periodically checking in with a C2 server
23. Which AccessData tool is specifically designed for mobile device data parsing and analysis, including iOS iTunes backups? → FTK Mobile Phone Examiner Plus (MPE+)
24. What is the primary purpose of conducting proficiency tests on forensic examiners? → To demonstrate examiner competency and verify consistent, accurate results
25. An investigator is preparing a lessons-learned report after a breach investigation. Which stakeholder group should this report primarily inform? → IT security, management, and relevant operations teams to improve prevention and response
26. Which scenario would require a accessdata certified investigator professional to escalate a accessdata investigator data recovery & file evaluation concern? → Creating feedback mechanisms that encourage continuous improvement
27. What is the primary objective of professional ethics & standards within the ACI professional framework? → Analyzing data systematically using validated assessment tools
28. An investigator discovers that the authorized HR contact has been forwarding case updates to the subject of the investigation. The immediate priority is to: → Notify legal counsel and suspend communications with the compromised contact
29. Which technique best helps an investigator communicate complex forensic timelines to a non-technical jury or board? → Using visual timeline charts with plain-language annotations
30. Which of the following is a key performance indicator for evaluating quality assurance & compliance effectiveness? → Prioritizing based on risk assessment and potential impact