Certified Fraud Examiner Digital Forensics and Technology Fraud Flashcards

When a CFE preserves digital evidence, what is the first critical step to ensure admissibility and integrity?

Answer: Create a forensic image and verify it with a hash value

Creating a bit-for-bit forensic image and verifying it with a cryptographic hash (MD5 or SHA) ensures the copy is identical to the original and preserves chain of custody.

Which metadata attribute can help a CFE determine when a document was originally created on a computer?

Answer: File creation timestamp

File creation timestamps stored in metadata can indicate when a document was first created, though they can be altered, so corroboration with other evidence is essential.

In digital forensics, what does the term 'chain of custody' refer to?

Answer: The documented handling of evidence from collection through trial

Chain of custody is the chronological documentation showing the seizure, custody, control, transfer, analysis, and disposition of physical or digital evidence.

Which tool is most commonly used by forensic examiners to recover deleted files from a hard drive?

Answer: EnCase or FTK (forensic imaging software)

Forensic imaging software such as EnCase or FTK (Forensic Toolkit) can recover deleted files by accessing unallocated disk space before it is overwritten.

What is 'steganography' in the context of digital fraud?

Answer: Hiding secret data within ordinary digital files such as images or audio

Steganography is the practice of concealing information within other non-secret data or files (e.g., hiding text inside an image) to avoid detection.

Under the Federal Rules of Evidence, electronically stored information (ESI) is considered which type of evidence?

Answer: Documentary evidence subject to authenticity requirements

ESI is treated as documentary evidence and must meet authenticity requirements under FRE Rule 901 to be admissible, demonstrating it is what the proponent claims.