CCE Legal & Ethical Issues in Digital Forensics 5

Question 1

Under international digital investigations, the Budapest Convention on Cybercrime primarily facilitates:

Accepted Answer

Cross-border cooperation and mutual legal assistance in cybercrime investigations

Answer

The Budapest Convention (Council of Europe Treaty No. 185) is the first international treaty harmonizing cybercrime laws and enabling cross-border evidence sharing.

Question 2

Which legal concept holds that digital evidence must be shown to be what it purports to be before it can be admitted in court?

Accepted Answer

Authentication

Answer

Authentication (FRE 901) requires the proponent to produce sufficient evidence that the item is what it is claimed to be.

Question 3

A forensic examiner is retained by a defense attorney. The examiner discovers evidence that strongly incriminates the defendant. The examiner must:

Accepted Answer

Report findings accurately and fully to the retaining attorney

Answer

The examiner must report findings fully and accurately to the retaining attorney; the attorney then bears responsibility for legal and ethical disclosure obligations.

Question 4

Which rule of evidence governs the admissibility of duplicates (copies) of original digital evidence in US federal courts?

Accepted Answer

FRE 1003 (Admissibility of Duplicates)

Answer

FRE 1003 provides that a duplicate is admissible to the same extent as an original unless authenticity is genuinely questioned.

Question 5

An investigator in a corporate setting fails to stop ongoing unauthorized network access to prevent evidence collection. This approach is known as:

Accepted Answer

The 'allow to run' or 'watch and wait' strategy

Answer

The 'watch and wait' approach allows an intrusion to continue under controlled observation to gather additional evidence, balanced against risk of ongoing harm.

(CCE) Certified Computer Examiner Practice Test

(CCE) Certified Computer Examiner Practice Test

CCE Legal & Ethical Issues in Digital Forensics 5