EnCE Legal Procedures 4

Question 1

What is the significance of a 'Daubert' hearing in the context of digital forensic testimony?

Accepted Answer

It is a pre-trial hearing where a judge evaluates whether expert testimony meets scientific reliability standards

Answer

Under Daubert v. Merrell Dow Pharmaceuticals, federal judges act as gatekeepers to assess whether expert testimony is based on sufficient facts and reliable methodology.

Question 2

An examiner is analyzing a corporate laptop under a consent agreement that limits the search to 'financial records.' The examiner discovers child exploitation images. What is the appropriate action?

Accepted Answer

Stop the search, preserve findings, and notify law enforcement to obtain proper legal authority

Answer

When evidence outside the scope of consent is discovered, the examiner should stop, preserve the findings, and allow law enforcement to obtain a warrant for the new evidence.

Question 3

What does 'hearsay' mean in the context of digital evidence, and which exception most commonly applies to business records?

Accepted Answer

Hearsay is out-of-court testimony; business records fall under FRE 803(6)

Answer

Hearsay is an out-of-court statement offered for the truth of the matter asserted; the business records exception under FRE 803(6) allows regularly kept records into evidence.

Question 4

Which federal statute primarily governs unauthorized access to computer systems and is commonly used in prosecuting computer intrusion cases?

Accepted Answer

Computer Fraud and Abuse Act (CFAA)

Answer

The Computer Fraud and Abuse Act (18 U.S.C. § 1030) is the primary federal law criminalizing unauthorized access to computers and related offenses.

Question 5

What is the purpose of a 'preservation letter' sent to a third-party service provider during an investigation?

Accepted Answer

To request voluntary preservation of specified records pending formal legal process

Answer

A preservation letter requests that a provider voluntarily preserve specified data while formal legal process (subpoena or warrant) is being obtained.

(EnCE) EnCase Certified Examiner Practice Test

(EnCE) EnCase Certified Examiner Practice Test

EnCE Legal Procedures 4