Criminal Investigation Procedures Flashcards

What is 'spoliation of evidence' in the context of a cybercrime investigation?

Answer: Intentional or negligent destruction of evidence relevant to litigation

Spoliation refers to the destruction, alteration, or failure to preserve evidence that is relevant to pending or foreseeable litigation, which can result in legal sanctions.

During a malware investigation, an analyst examines a suspicious process running in memory. Which technique allows capture of process memory contents without shutting down the system?

Answer: Live memory acquisition/dumping

Live memory acquisition (memory dumping) captures the contents of RAM from a running system, preserving malware artifacts, encryption keys, and network connections that would be lost on shutdown.

A company discovers it has been breached and engages outside counsel to lead the forensic investigation. What is the primary legal benefit of this arrangement?

Answer: Forensic findings may be protected by attorney-client privilege

When forensic investigators work at the direction of legal counsel, their work product and communications may qualify for attorney-client privilege or work product protection, shielding findings from disclosure.

Which provision of the USA PATRIOT Act significantly expanded law enforcement's ability to conduct roving wiretaps in cybercrime investigations?

Answer: Section 206

Section 206 of the PATRIOT Act authorized 'roving' wiretaps that follow a specific target across multiple devices and communication services, rather than being tied to a single device.

An incident responder identifies a compromised server actively exfiltrating data. Before isolating the server, what should the responder prioritize collecting?

Answer: Running process list and network connections

Volatile data including active network connections and running processes must be captured before isolation, since this information reveals attacker activity and will be lost once the network connection is severed.

What is the 'plain view' doctrine and how does it apply to digital forensic searches?

Answer: Evidence in plain sight during a lawful search can be seized without an additional warrant

The plain view doctrine permits seizure of evidence discovered incidentally during a lawful search, but courts have applied it cautiously in digital cases because opening any folder could expose unrelated private data.

A ransomware group is based in a country with no extradition treaty with the US. What is the primary enforcement mechanism US authorities can use against these actors?

Answer: Indictment, sanctions, and disruption operations

Without extradition treaties, the US relies on federal indictments (which deter travel), Treasury sanctions (blocking financial access), and technical disruption operations to combat ransomware actors in non-extraditing countries.