FBI FBI Cybercrime and Digital Forensics 2 — Questions and Answers
Question 1: What is the FBI's Internet Crime Complaint Center (IC3)?
- A classified cyber intelligence database
- A public-facing portal where citizens and businesses report internet-based crimes to the FBI (Correct answer)
- A coordination center for international cyber operations
- A division that prosecutes computer crimes
Correct answer: A public-facing portal where citizens and businesses report internet-based crimes to the FBI
IC3 (www.ic3.gov) is the FBI's public complaint portal for internet crime, receiving and analyzing millions of complaints annually and referring cases to appropriate law enforcement.
Question 2: What chain-of-custody step is most critical when an FBI agent seizes a live computer system running as evidence?
- Immediately powering off the system to prevent data alteration
- Documenting the running state, capturing volatile memory (RAM) before imaging, then powering off (Correct answer)
- Removing the hard drive immediately without powering down
- Taking photographs and logging in with admin credentials to preserve files
Correct answer: Documenting the running state, capturing volatile memory (RAM) before imaging, then powering off
With live systems, volatile data in RAM (encryption keys, running processes, network connections) must be captured first because it is lost when power is removed, then a forensic image of storage drives is made.
Question 3: What federal law governs FBI access to stored email content held by providers like Google or Microsoft?
- The Computer Fraud and Abuse Act
- The Electronic Communications Privacy Act (ECPA) / Stored Communications Act (Correct answer)
- The Foreign Intelligence Surveillance Act
- The Privacy Act of 1974
Correct answer: The Electronic Communications Privacy Act (ECPA) / Stored Communications Act
The Stored Communications Act (18 U.S.C. §§ 2701-2712), part of ECPA, governs government access to stored electronic communications and requires different legal processes depending on content age and type.
Question 4: What is 'spear phishing' as used in FBI cyber case classifications?
- A bulk phishing campaign targeting millions of random users
- A highly targeted phishing attack customized to a specific individual or organization to gain access to systems or credentials (Correct answer)
- A phishing attack delivered via SMS text message
- An attack that spoofs the FBI's own domain to deceive victims
Correct answer: A highly targeted phishing attack customized to a specific individual or organization to gain access to systems or credentials
Spear phishing uses personalized, research-based deception targeting specific individuals — often executives or employees with system access — to steal credentials or deploy malware.
Question 5: What is the purpose of a forensic 'write blocker' in an FBI digital evidence examination?
- To prevent suspects from overwriting encrypted files remotely
- To ensure that connecting a storage device for analysis does not alter or write any data to the original evidence (Correct answer)
- To block unauthorized write access to the Sentinel case management system
- To prevent agents from modifying digital evidence reports after filing
Correct answer: To ensure that connecting a storage device for analysis does not alter or write any data to the original evidence
A write blocker is a hardware or software device that allows data to be read from a storage medium for forensic imaging while preventing any data from being written back, preserving evidence integrity.
Question 6: Under U.S. law, cryptocurrency transactions on a public blockchain are considered what from an FBI investigative standpoint?
- Fully private and inaccessible without a court order
- Pseudonymous — traceable through blockchain analysis to identify transacting parties (Correct answer)
- Completely anonymous and unattributable
- Classified as currency exchanges requiring Treasury Department jurisdiction
Correct answer: Pseudonymous — traceable through blockchain analysis to identify transacting parties
Public blockchains are permanent, public ledgers; while addresses are pseudonymous, blockchain analytics tools allow the FBI to trace transactions and link addresses to real identities through exchange records.
FBI FBI Cybercrime and Digital Forensics 2
What is the FBI's Internet Crime Complaint Center (IC3)?