CCE Legal & Ethical Issues in Digital Forensics 5 — Questions and Answers
Question 1: Under international digital investigations, the Budapest Convention on Cybercrime primarily facilitates:
- Uniform sentencing for cybercriminals worldwide
- Cross-border cooperation and mutual legal assistance in cybercrime investigations (Correct answer)
- A global digital evidence standards body
- Extradition of all cybercrime suspects to the US
Correct answer: Cross-border cooperation and mutual legal assistance in cybercrime investigations
The Budapest Convention (Council of Europe Treaty No. 185) is the first international treaty harmonizing cybercrime laws and enabling cross-border evidence sharing.
Question 2: Which legal concept holds that digital evidence must be shown to be what it purports to be before it can be admitted in court?
- Relevance
- Authentication (Correct answer)
- Hearsay exception
- Best evidence rule
Correct answer: Authentication
Authentication (FRE 901) requires the proponent to produce sufficient evidence that the item is what it is claimed to be.
Question 3: A forensic examiner is retained by a defense attorney. The examiner discovers evidence that strongly incriminates the defendant. The examiner must:
- Conceal the findings from the prosecution
- Report findings accurately and fully to the retaining attorney (Correct answer)
- Report directly to the court without telling the attorney
- Destroy the evidence to protect the client
Correct answer: Report findings accurately and fully to the retaining attorney
The examiner must report findings fully and accurately to the retaining attorney; the attorney then bears responsibility for legal and ethical disclosure obligations.
Question 4: Which rule of evidence governs the admissibility of duplicates (copies) of original digital evidence in US federal courts?
- FRE 801 (Hearsay)
- FRE 1003 (Admissibility of Duplicates) (Correct answer)
- FRE 404 (Character Evidence)
- FRE 602 (Personal Knowledge)
Correct answer: FRE 1003 (Admissibility of Duplicates)
FRE 1003 provides that a duplicate is admissible to the same extent as an original unless authenticity is genuinely questioned.
Question 5: An investigator in a corporate setting fails to stop ongoing unauthorized network access to prevent evidence collection. This approach is known as:
- Entrapment
- Monitoring under the banner exception
- The 'allow to run' or 'watch and wait' strategy (Correct answer)
- Parallel construction
Correct answer: The 'allow to run' or 'watch and wait' strategy
The 'watch and wait' approach allows an intrusion to continue under controlled observation to gather additional evidence, balanced against risk of ongoing harm.
Question 6: The concept of 'attorney-client privilege' in digital forensics investigations means that:
- All files on a corporate network are automatically privileged
- Communications between a client and their attorney may be protected from disclosure (Correct answer)
- Forensic reports prepared for litigation are always discoverable
- An examiner hired by an attorney can refuse all testimony
Correct answer: Communications between a client and their attorney may be protected from disclosure
Attorney-client privilege protects confidential communications between attorney and client made for the purpose of seeking or providing legal advice.
Question 7: When a forensic examiner testifies as an expert witness, they are permitted to do something fact witnesses are not, which is:
- Refuse to answer cross-examination questions
- Offer opinions and draw conclusions based on specialized knowledge (Correct answer)
- Introduce physical evidence into the record
- Waive privilege on behalf of the client
Correct answer: Offer opinions and draw conclusions based on specialized knowledge
Under FRE 702, expert witnesses may offer opinion testimony based on their specialized knowledge, skill, experience, training, or education.
CCE Legal & Ethical Issues in Digital Forensics 5
Under international digital investigations, the Budapest Convention on Cybercrime primarily facilitates: