CFE Certified Fraud Examiner Digital Forensics and Technology Fraud 2

Question 1

When a CFE preserves digital evidence, what is the first critical step to ensure admissibility and integrity?

Accepted Answer

Create a forensic image and verify it with a hash value

Answer

Copy files directly onto the investigator's laptop

Answer

Delete temporary files to reduce storage

Answer

Open and review files on the original device

Question 2

Which metadata attribute can help a CFE determine when a document was originally created on a computer?

Accepted Answer

File creation timestamp

Answer

File size

Answer

File extension

Answer

Font embedded in the document

Question 3

In digital forensics, what does the term 'chain of custody' refer to?

Accepted Answer

The documented handling of evidence from collection through trial

Answer

The sequence of financial transactions in a fraud scheme

Answer

The hierarchy of management involved in approving transactions

Answer

The order in which computer files were accessed

Question 4

Which tool is most commonly used by forensic examiners to recover deleted files from a hard drive?

Accepted Answer

EnCase or FTK (forensic imaging software)

Answer

SQL query analyzer

Answer

Wireshark (network packet analyzer)

Answer

Splunk (log management platform)

Question 5

What is 'steganography' in the context of digital fraud?

Accepted Answer

Hiding secret data within ordinary digital files such as images or audio

Answer

Encrypting financial data using advanced algorithms

Answer

Creating fake digital invoices with embedded macros

Answer

Spoofing IP addresses to hide network activity

Question 6

Under the Federal Rules of Evidence, electronically stored information (ESI) is considered which type of evidence?

Accepted Answer

Documentary evidence subject to authenticity requirements

Answer

Hearsay evidence inadmissible without exception

Answer

Demonstrative evidence only

Answer

Privileged evidence exempt from discovery