CrFA Digital Forensics & Data Analysis Flashcards

In data analytics for fraud detection, stratification of transactions is used to:

Answer: Group transactions into ranges to identify unusual concentrations

Stratification organizes data into layers or bands so the examiner can see where transaction volumes or amounts cluster abnormally.

Which hashing algorithm is most commonly used to verify the integrity of a forensic disk image?

Answer: SHA-256

SHA-256 produces a unique cryptographic hash of the original data, allowing the examiner to confirm the copy is bit-for-bit identical to the source.

A forensic accountant discovers that journal entries were systematically posted at 2:00 a.m. by a generic user account. This finding most likely indicates:

Answer: Possible unauthorized or fraudulent entries made to avoid detection

Unusual posting times combined with generic credentials are red flags suggesting entries may have been made deliberately outside business hours to evade oversight.

Which technique involves comparing a company's reported financial ratios to industry benchmarks to identify anomalies?

Answer: Ratio analysis

Ratio analysis compares key financial metrics such as gross margin or days payable outstanding against peer companies to highlight deviations that may signal fraud.

When recovering deleted files during a forensic investigation, the examiner looks for data in which area of a hard drive?

Answer: Unallocated clusters or slack space

Deleted files are often recoverable from unallocated clusters and file slack space before those areas are overwritten by new data.

In forensic accounting, network log analysis is primarily used to:

Answer: Identify unauthorized data transfers or access to sensitive financial records

Network logs record connection events and file access, allowing examiners to trace who accessed financial data and whether information was exfiltrated.