CSX Criminal Investigation Procedures 3 — Questions and Answers
Question 1: Which type of court order specifically authorizes law enforcement to capture real-time communications content, requiring a showing of probable cause and necessity?
- Administrative subpoena
- Pen register order
- Title III wiretap order (Correct answer)
- Section 2703(d) order
Correct answer: Title III wiretap order
A Title III wiretap order under the Wiretap Act authorizes interception of real-time communications content and requires a high legal standard including probable cause and a necessity showing.
Question 2: What is the purpose of a 'write blocker' in digital forensic investigations?
- Encrypts data before analysis
- Prevents modification of evidence during imaging (Correct answer)
- Blocks unauthorized network access
- Filters write activity in log files
Correct answer: Prevents modification of evidence during imaging
A write blocker is a hardware or software device that prevents any write commands from reaching the evidence drive, preserving its original state during forensic imaging.
Question 3: During a ransomware investigation, investigators find cryptocurrency ransom payments. Which agency has primary authority to investigate cryptocurrency-based money laundering in the US?
- IRS Criminal Investigation (CI) (Correct answer)
- SEC Division of Enforcement
- FinCEN
- OCC
Correct answer: IRS Criminal Investigation (CI)
IRS Criminal Investigation (CI) has primary federal authority and specialized expertise in investigating financial crimes including cryptocurrency-based money laundering.
Question 4: What does the term 'locard's exchange principle' mean in the context of cybercrime investigations?
- Every contact leaves a trace (Correct answer)
- Evidence must be exchanged between jurisdictions
- Warrants must be exchanged before searches
- Logs must be shared with all investigators
Correct answer: Every contact leaves a trace
Locard's Exchange Principle states that every contact between a perpetrator and a crime scene results in an exchange of material; in digital forensics, attackers always leave traces in logs, memory, or storage.
Question 5: A suspect's encrypted laptop is seized. Law enforcement cannot compel the suspect to reveal the password under which constitutional protection?
- First Amendment (free speech)
- Fourth Amendment (unreasonable search)
- Fifth Amendment (self-incrimination) (Correct answer)
- Sixth Amendment (right to counsel)
Correct answer: Fifth Amendment (self-incrimination)
The Fifth Amendment protection against self-incrimination may prevent law enforcement from compelling a suspect to reveal an encryption password, as it is a testimonial act.
Question 6: Which type of volatile data should be collected FIRST when responding to a live system during an investigation, per order-of-volatility principles?
- Swap/pagefile contents
- CPU registers and cache (Correct answer)
- Temporary files on disk
- System event logs
Correct answer: CPU registers and cache
CPU registers and cache are the most volatile data (lost immediately when power is cut), so they must be captured first according to the order-of-volatility principle in live forensics.
Question 7: What legal standard must law enforcement meet to obtain a search warrant for digital evidence under the Fourth Amendment?
- Reasonable suspicion
- Probable cause (Correct answer)
- Preponderance of the evidence
- Clear and convincing evidence
Correct answer: Probable cause
The Fourth Amendment requires law enforcement to demonstrate probable cause — a reasonable belief that evidence of a crime will be found — to obtain a search warrant.
CSX Criminal Investigation Procedures 3
Which type of court order specifically authorizes law enforcement to capture real-time communications content, requiring a showing of probable cause and necessity?