OIC Technology & Digital Investigations Flashcards

Which legal authority is typically required before an OIC inspector can access private electronic records stored on a third-party server?

Answer: A valid subpoena or court order directed to the service provider

Accessing private electronic records held by third-party providers requires a subpoena or court order under the Electronic Communications Privacy Act.

Social media data collected during an OIC investigation should be preserved using:

Answer: Screenshots with timestamps and URL documentation, or a certified capture tool

Social media evidence must be captured with verifiable timestamps and source URLs, ideally using certified tools, to establish authenticity.

When an investigation involves encrypted files that cannot be accessed, an OIC inspector should:

Answer: Document the encrypted files and consult a digital forensics specialist or legal counsel for decryption options

Encrypted files must be documented, and legal options including compelling decryption or using forensic tools should be explored with specialists.

IP address logs obtained during a digital investigation are best used to:

Answer: Identify the origin of network activity and associate it with a location or account

IP logs identify network activity origins and can be corroborated with other evidence, but alone they do not conclusively identify an individual.

In the context of OIC digital investigations, 'chain of custody' for electronic evidence means:

Answer: A documented record of every person who accessed or handled the evidence from seizure to court

Chain of custody is the documented history of who handled evidence, ensuring it has not been tampered with between collection and presentation.

An OIC inspector discovers deleted files on a seized computer. These files:

Answer: May be recoverable using forensic software and are potentially admissible as evidence

Deleted files often remain recoverable from unallocated disk space using forensic tools until they are overwritten.