CFE Certified Fraud Examiner Digital Forensics and Technology Fraud 2

Question 1

When a CFE preserves digital evidence, what is the first critical step to ensure admissibility and integrity?

Accepted Answer

Create a forensic image and verify it with a hash value

Answer

Creating a bit-for-bit forensic image and verifying it with a cryptographic hash (MD5 or SHA) ensures the copy is identical to the original and preserves chain of custody.

Question 2

Which metadata attribute can help a CFE determine when a document was originally created on a computer?

Accepted Answer

File creation timestamp

Answer

File creation timestamps stored in metadata can indicate when a document was first created, though they can be altered, so corroboration with other evidence is essential.

Question 3

In digital forensics, what does the term 'chain of custody' refer to?

Accepted Answer

The documented handling of evidence from collection through trial

Answer

Chain of custody is the chronological documentation showing the seizure, custody, control, transfer, analysis, and disposition of physical or digital evidence.

Question 4

Which tool is most commonly used by forensic examiners to recover deleted files from a hard drive?

Accepted Answer

EnCase or FTK (forensic imaging software)

Answer

Forensic imaging software such as EnCase or FTK (Forensic Toolkit) can recover deleted files by accessing unallocated disk space before it is overwritten.

Question 5

What is 'steganography' in the context of digital fraud?

Accepted Answer

Hiding secret data within ordinary digital files such as images or audio

Answer

Steganography is the practice of concealing information within other non-secret data or files (e.g., hiding text inside an image) to avoid detection.

Certified Fraud Examiner Exam Practice Test

Certified Fraud Examiner Exam Practice Test

CFE Certified Fraud Examiner Digital Forensics and Technology Fraud 2