CFE Legal Frameworks & Regulatory Standards 4

Question 1

Under the Electronic Communications Privacy Act (ECPA), a law enforcement agency seeking stored email content more than 180 days old must obtain:

Accepted Answer

A search warrant

Answer

After the Sixth Circuit's Warshak decision and subsequent DOJ policy, a search warrant supported by probable cause is required to obtain stored email content regardless of age.

Question 2

In a civil litigation context, what is the primary purpose of a litigation hold notice?

Accepted Answer

To suspend routine document destruction to preserve potentially relevant evidence

Answer

A litigation hold notice instructs custodians to suspend normal retention/destruction schedules and preserve documents potentially relevant to anticipated or pending litigation.

Question 3

The USA PATRIOT Act expanded which government authority to allow collection of 'tangible things' relevant to a terrorism investigation without a traditional warrant?

Accepted Answer

Section 215 business records authority

Answer

Section 215 of the PATRIOT Act (amending FISA) allowed the FBI to obtain a FISA court order for any tangible things relevant to a terrorism or intelligence investigation.

Question 4

A forensic examiner discovers evidence of a crime unrelated to the original search warrant scope during a digital examination. Under the 'plain view' doctrine, seizure of that evidence is lawful if:

Accepted Answer

The incriminating nature of the evidence is immediately apparent without further analysis

Answer

Plain view seizure requires that the item's incriminating nature be immediately apparent — the examiner cannot conduct additional analysis to determine whether something is evidence.

Question 5

Which regulatory framework requires financial institutions to file a Suspicious Activity Report (SAR) within 30 calendar days of detecting a suspicious transaction?

Accepted Answer

Bank Secrecy Act / FinCEN regulations

Answer

The Bank Secrecy Act, implemented through FinCEN regulations, requires covered financial institutions to file SARs within 30 days of identifying a suspicious transaction.

(CFE) Certified Forensic Examiner Practice Test

(CFE) Certified Forensic Examiner Practice Test

CFE Legal Frameworks & Regulatory Standards 4