Technology & Digital Tools Flashcards

Which federal law primarily governs law enforcement access to stored electronic communications such as emails and cloud data?

Answer: Electronic Communications Privacy Act (ECPA)

ECPA, which includes the Stored Communications Act, sets the legal standards for government access to stored emails, messages, and other electronic data.

When analyzing a Windows system, which artifact MOST reliably records the last time a file was accessed by the user?

Answer: $MFT (Master File Table) timestamps

The NTFS Master File Table maintains MAC (Modified, Accessed, Created) timestamps for every file on the volume.

An investigator is reviewing surveillance video evidence. Which practice is essential for maintaining the video's legal admissibility?

Answer: Documenting chain of custody and maintaining the original unedited copy

Proper chain of custody documentation and preservation of the unaltered original are fundamental to ensuring video evidence is admissible in court.

Which tool is specifically designed to aggregate and visualize relationships between entities such as people, organizations, and IP addresses during OSINT investigations?

Answer: Maltego

Maltego is an OSINT and link-analysis platform that maps connections between entities using graphical relationship charts called 'transforms.'

A private investigator is hired to locate a subject using their vehicle. Which technology legally allows tracking without physical contact with the vehicle?

Answer: License plate reader (LPR) network data requests

License plate reader databases record vehicle movements passively on public roads; investigators can legally request records from operators without touching the vehicle.

In the context of mobile device forensics, what does 'logical extraction' refer to?

Answer: Acquiring data through the device's operating system and file-sharing interfaces

Logical extraction accesses data via the device's OS or sync protocols (e.g., iTunes backup, ADB), retrieving files the OS exposes rather than raw sectors.

Which type of cyberattack involves an investigator's target receiving an email appearing to come from a trusted source in order to steal credentials?

Answer: Spear phishing

Spear phishing is a targeted deception attack where a crafted email mimics a trusted sender to trick a specific individual into revealing credentials.