CrFA Digital Forensics & Data Analysis Flashcards

Which federal standard governs the admissibility of digital evidence in U.S. federal courts?

Answer: Federal Rules of Evidence Rule 901

Federal Rules of Evidence Rule 901 requires authentication of digital evidence by showing it is what the proponent claims it to be.

A forensic accountant uses a write blocker when imaging a hard drive primarily to:

Answer: Prevent alteration of the original evidence

A write blocker prevents any data from being written to the original drive, preserving the integrity of the evidence.

When analyzing financial data for fraud, which ACL/IDEA function is most useful for identifying duplicate invoice payments?

Answer: Duplicate key detection

Duplicate key detection compares fields such as invoice number, vendor, and amount to flag transactions that appear more than once.

Benford's Law is most effective in detecting fraud when applied to which type of dataset?

Answer: Naturally occurring financial amounts across a wide range

Benford's Law applies to naturally occurring data spanning several orders of magnitude, where the leading digits follow a predictable logarithmic distribution.

During e-discovery in a forensic accounting investigation, metadata is important because it can reveal:

Answer: When a document was created, modified, or accessed

File metadata such as creation date, last modified date, and author information can help establish timelines and detect document tampering.

A chain of custody document in a digital forensics investigation is maintained to:

Answer: Track who handled evidence and when, ensuring its integrity

Chain of custody establishes a documented record of every person who accessed evidence, protecting against claims of tampering or contamination.