FBI FBI Cybercrime and Digital Forensics 2

Question 1

What is the FBI's Internet Crime Complaint Center (IC3)?

Accepted Answer

A public-facing portal where citizens and businesses report internet-based crimes to the FBI

Answer

IC3 (www.ic3.gov) is the FBI's public complaint portal for internet crime, receiving and analyzing millions of complaints annually and referring cases to appropriate law enforcement.

Question 2

What chain-of-custody step is most critical when an FBI agent seizes a live computer system running as evidence?

Accepted Answer

Documenting the running state, capturing volatile memory (RAM) before imaging, then powering off

Answer

With live systems, volatile data in RAM (encryption keys, running processes, network connections) must be captured first because it is lost when power is removed, then a forensic image of storage drives is made.

Question 3

What federal law governs FBI access to stored email content held by providers like Google or Microsoft?

Accepted Answer

The Electronic Communications Privacy Act (ECPA) / Stored Communications Act

Answer

The Stored Communications Act (18 U.S.C. §§ 2701-2712), part of ECPA, governs government access to stored electronic communications and requires different legal processes depending on content age and type.

Question 4

What is 'spear phishing' as used in FBI cyber case classifications?

Accepted Answer

A highly targeted phishing attack customized to a specific individual or organization to gain access to systems or credentials

Answer

Spear phishing uses personalized, research-based deception targeting specific individuals — often executives or employees with system access — to steal credentials or deploy malware.

Question 5

What is the purpose of a forensic 'write blocker' in an FBI digital evidence examination?

Accepted Answer

To ensure that connecting a storage device for analysis does not alter or write any data to the original evidence

Answer

A write blocker is a hardware or software device that allows data to be read from a storage medium for forensic imaging while preventing any data from being written back, preserving evidence integrity.

FBI Special Agent Test Practice Test

FBI Special Agent Test Practice Test

FBI FBI Cybercrime and Digital Forensics 2