ACI Study Guide 2026
Everything you need to pass the ACI exam in one place: the exam format, every topic to study, real practice questions with explanations, flashcards, and full-length practice tests. Free, no sign-up needed.
📋 ACI Exam Format at a Glance
📚 ACI Topics to Study (37)
✍️ Sample ACI Questions & Answers
1. Which principle ensures that a forensic examination can be repeated by another qualified examiner with the same tools and produce the same results?
Reproducibility is a core scientific and quality principle requiring that documented methods produce consistent results when repeated under the same conditions.
2. A forensic examiner is asked by their employer to alter timestamps in a report to make evidence appear more recent. The correct ethical response is to:
Falsifying evidence is illegal and unethical; the examiner must refuse and document the request to protect themselves.
3. Which document type defines the step-by-step processes that forensic examiners must follow to ensure consistency and reproducibility?
SOPs provide detailed, standardized instructions that ensure all examiners perform analyses the same way, supporting reproducibility and quality.
4. Which SQLite database on an iPhone stores both SMS and iMessage communications?
The sms.db SQLite database located at /var/mobile/Library/SMS/ on iOS devices stores all SMS text messages and iMessages, including sender/receiver data and timestamps.
5. What is the primary legal concern in digital forensics?
The primary legal concern in digital forensics is ensuring that all evidence is obtained legally and in accordance with established laws and regulations. If digital evidence is collected without proper authorization, such as a warrant, or through illegal means, it may be deemed inadmissible in court. Adherence to legal procedures is fundamental to the integrity and success of any forensic investigation, protecting both the investigation and the rights of individuals.
6. During an investigation, a department head outside the need-to-know circle asks the investigator directly about case status. The best response is to:
Investigators should neither confirm full details nor deny the investigation to unauthorized parties — they should redirect to the designated case contact.