EnCE Legal Procedures 3 — Questions and Answers
Question 1: A company discovers an employee has been stealing trade secrets and contacts law enforcement. Before police arrive, the IT department creates a forensic image of the suspect's workstation. What issue may arise?
- Private searches are always inadmissible in criminal proceedings
- The image may not be admissible because IT staff lacked a warrant
- A private party search does not trigger Fourth Amendment protections, but evidence handling must still preserve integrity (Correct answer)
- The company must obtain a court order before any internal forensic activity
Correct answer: A private party search does not trigger Fourth Amendment protections, but evidence handling must still preserve integrity
The Fourth Amendment applies to government actors, so private company searches do not require a warrant, but proper evidence handling is still critical for admissibility.
Question 2: Which legal concept permits investigators to expand the scope of a digital search when contraband is found incidentally during a lawfully scoped search?
- Inevitable discovery
- Good faith exception
- Plain view doctrine (Correct answer)
- Exigent circumstances
Correct answer: Plain view doctrine
The plain view doctrine allows seizure of incidentally discovered evidence when the officer is lawfully present and the incriminating nature is immediately apparent.
Question 3: What is a 'litigation hold' and when should it be issued?
- A court order freezing all company assets pending judgment
- A directive to preserve all potentially relevant evidence once litigation is reasonably anticipated (Correct answer)
- An injunction preventing a party from deleting files after a lawsuit is filed
- A subpoena requiring the production of electronic documents
Correct answer: A directive to preserve all potentially relevant evidence once litigation is reasonably anticipated
A litigation hold (legal hold) is a directive to suspend routine document destruction once litigation is reasonably anticipated to prevent spoliation.
Question 4: Under the Federal Rules of Civil Procedure, what is 'electronically stored information' (ESI)?
- Only emails and word-processing documents
- Any information created, stored, or transmitted in digital form (Correct answer)
- Data stored on servers operated by third-party cloud providers
- Electronic records that have been authenticated with a digital signature
Correct answer: Any information created, stored, or transmitted in digital form
ESI under the FRCP broadly encompasses any information created, stored, or transmitted in electronic form, regardless of media type.
Question 5: What is the legal effect of 'spoliation' of evidence in a civil proceeding?
- Automatic dismissal of the case
- Criminal charges against the responsible party
- An adverse inference instruction or sanctions against the spoliating party (Correct answer)
- Exclusion of all other evidence submitted by that party
Correct answer: An adverse inference instruction or sanctions against the spoliating party
Courts typically respond to spoliation with sanctions such as adverse inference jury instructions, monetary penalties, or case dismissal in severe cases.
Question 6: Which exception to the warrant requirement allows officers to seize and search a computer without a warrant when someone with apparent authority gives consent?
- Exigent circumstances exception
- Third-party consent doctrine (Correct answer)
- Good faith exception
- Emergency aid exception
Correct answer: Third-party consent doctrine
The third-party consent doctrine permits a warrantless search when a person with apparent authority over the area or device voluntarily consents.
Question 7: In a criminal case, what is the standard of proof the prosecution must meet to secure a conviction?
- Preponderance of the evidence
- Clear and convincing evidence
- Reasonable suspicion
- Beyond a reasonable doubt (Correct answer)
Correct answer: Beyond a reasonable doubt
Criminal convictions require the prosecution to prove each element of the offense beyond a reasonable doubt, the highest legal standard.
EnCE Legal Procedures 3
A company discovers an employee has been stealing trade secrets and contacts law enforcement.
Before police arrive, the IT department creates a forensic image of the suspect's workstation.
What issue may arise?