Professional Ethics & Standards Flashcards
7 cards from real ACI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Professional Ethics & Standards flashcards as text
An investigator discovers evidence during a civil case that suggests the subject committed an unrelated federal crime. What is the most ethically appropriate immediate action?
Answer: Report findings to supervising counsel and let legal determine next steps
Investigators should report out-of-scope findings to supervising counsel rather than acting unilaterally, as legal obligations vary by jurisdiction and context.
Which principle requires a digital forensic investigator to present findings that are unfavorable to the retaining party if they are factually accurate?
Answer: Impartiality
Impartiality requires investigators to report all accurate findings regardless of which party retained them.
A forensic examiner is asked by their employer to alter timestamps in a report to make evidence appear more recent. The correct ethical response is to:
Answer: Refuse and document the request
Falsifying evidence is illegal and unethical; the examiner must refuse and document the request to protect themselves.
Which document formally establishes the boundaries and permissions granted to a digital investigator before an examination begins?
Answer: Authorization to examine (scope agreement or search warrant)
A scope agreement, search warrant, or equivalent authorization defines exactly what the investigator is permitted to access and examine.
An investigator finds child exploitation material while conducting a corporate fraud examination. What is the mandatory ethical and legal obligation?
Answer: Report it immediately to law enforcement per mandatory reporting laws
Child exploitation material triggers mandatory reporting laws (e.g., NCMEC CyberTipline requirement) that override all other investigative priorities.
The concept of 'minimization' in digital forensic ethics refers to:
Answer: Limiting access to and collection of data beyond what is legally authorized
Minimization requires investigators to collect only data within the authorized scope and avoid unnecessarily accessing private information.
When an investigator testifies as a fact witness rather than an expert witness, they are limited to:
Answer: Testifying only about what they personally observed or did
A fact witness may only testify about direct personal observations and actions, unlike an expert witness who may offer opinions.