ACI Professional Ethics & Standards 2

Question 1

An investigator discovers evidence during a civil case that suggests the subject committed an unrelated federal crime. What is the most ethically appropriate immediate action?

Accepted Answer

Report findings to supervising counsel and let legal determine next steps

Answer

Delete the evidence to stay within scope

Answer

Immediately contact federal law enforcement independently

Answer

Ignore the evidence since it is outside the investigation scope

Question 2

Which principle requires a digital forensic investigator to present findings that are unfavorable to the retaining party if they are factually accurate?

Accepted Answer

Impartiality

Answer

Advocacy

Answer

Confidentiality

Answer

Proportionality

Question 3

A forensic examiner is asked by their employer to alter timestamps in a report to make evidence appear more recent. The correct ethical response is to:

Accepted Answer

Refuse and document the request

Answer

Comply since employers direct the work

Answer

Alter only minor timestamps that won't affect the case outcome

Answer

Ask a colleague to do it instead

Question 4

Which document formally establishes the boundaries and permissions granted to a digital investigator before an examination begins?

Accepted Answer

Authorization to examine (scope agreement or search warrant)

Answer

Chain of custody form

Answer

Expert witness affidavit

Answer

Incident response plan

Question 5

An investigator finds child exploitation material while conducting a corporate fraud examination. What is the mandatory ethical and legal obligation?

Accepted Answer

Report it immediately to law enforcement per mandatory reporting laws

Answer

Preserve it as corporate evidence and continue the fraud investigation

Answer

Quarantine the device and await further corporate instructions

Answer

Delete it to protect the organization from liability

Question 6

The concept of 'minimization' in digital forensic ethics refers to:

Accepted Answer

Limiting access to and collection of data beyond what is legally authorized

Answer

Reducing the file sizes of forensic images

Answer

Minimizing the time spent on examinations

Answer

Reducing the cost of forensic services

Question 7

When an investigator testifies as a fact witness rather than an expert witness, they are limited to:

Accepted Answer

Testifying only about what they personally observed or did

Answer

Offering opinions about industry best practices

Answer

Drawing conclusions from the evidence they analyzed

Answer

Explaining complex technical concepts to the jury