EnCE Legal Procedures 2

Question 1

Which legal standard must investigators meet when seeking a search warrant for digital evidence in the United States?

Accepted Answer

Probable cause

Answer

The Fourth Amendment requires probable cause supported by an oath or affirmation before a judge can issue a search warrant.

Question 2

Under the Electronic Communications Privacy Act (ECPA), which category of stored electronic communications requires a search warrant to compel disclosure from a service provider?

Accepted Answer

Unopened email stored less than 180 days

Answer

ECPA requires a search warrant for unopened electronic communications stored for 180 days or fewer, providing the strongest protection.

Question 3

What is the primary purpose of a 'chain of custody' document in digital forensics?

Accepted Answer

To track all persons who accessed or handled evidence

Answer

Chain of custody documentation tracks every person who handled the evidence, ensuring its integrity and admissibility in court.

Question 4

A forensic examiner is subpoenaed to testify about findings in a civil case. In what capacity is the examiner most likely testifying?

Accepted Answer

Expert witness

Answer

A forensic examiner with specialized knowledge testifies as an expert witness, allowed to offer opinions beyond direct observations.

Question 5

Which doctrine allows evidence obtained in violation of the Fourth Amendment to be excluded from trial?

Accepted Answer

The exclusionary rule

Answer

The exclusionary rule prohibits the use of illegally obtained evidence in a criminal trial to deter unlawful police conduct.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Legal Procedures 2