PILB Digital Forensics and Cyber Investigations 1 — Questions and Answers
Question 1: A Nevada PI is asked to recover deleted files from a client's computer as part of a civil case. The PI should:
- Use a forensic imaging tool to create a bit-for-bit copy before any analysis (Correct answer)
- Directly browse the hard drive to find deleted files
- Reformat the drive to ensure a clean search
- Ask the subject to recover the files themselves
Correct answer: Use a forensic imaging tool to create a bit-for-bit copy before any analysis
Creating a forensic image preserves the original evidence and maintains chain of custody required for legal proceedings.
Question 2: Which federal law prohibits unauthorized access to computer systems, making it relevant to cyber investigations conducted by Nevada PIs?
- Computer Fraud and Abuse Act (CFAA) (Correct answer)
- Electronic Communications Privacy Act (ECPA)
- Digital Millennium Copyright Act (DMCA)
- Stored Communications Act (SCA)
Correct answer: Computer Fraud and Abuse Act (CFAA)
The CFAA criminalizes unauthorized access to computer systems and is the primary federal statute governing computer intrusion.
Question 3: A PI is monitoring a suspect's social media activity for a client. To legally collect evidence from a public social media profile, the PI should:
- Screenshot and archive publicly visible posts with timestamps using OSINT tools (Correct answer)
- Create a fake profile to befriend the subject and access private content
- Hack into the subject's account to view private messages
- File a subpoena to the social media company for all account data
Correct answer: Screenshot and archive publicly visible posts with timestamps using OSINT tools
Publicly visible social media content can be legally collected through open-source intelligence techniques without deception or unauthorized access.
Question 4: Chain of custody in digital evidence handling means:
- Documenting every person who accessed or handled the evidence from collection to court presentation (Correct answer)
- Encrypting all digital files at rest
- Storing evidence on multiple cloud platforms simultaneously
- Allowing only the client to handle digital evidence
Correct answer: Documenting every person who accessed or handled the evidence from collection to court presentation
Chain of custody ensures the integrity and admissibility of digital evidence by tracking all access and handling from collection through presentation.
Question 5: When a Nevada PI collects metadata from a digital photograph as evidence, the metadata can reveal:
- Date, time, GPS coordinates, and device information embedded in the file (Correct answer)
- Only the file name and size
- The subject's Social Security number
- The content of encrypted messages on the device
Correct answer: Date, time, GPS coordinates, and device information embedded in the file
EXIF metadata embedded in digital photos can include date/time stamps, GPS location data, and the specific device used to take the photo.
Question 6: A client provides a PI with login credentials to access a subject's email account to gather evidence. Accessing the account using these credentials is:
- A federal crime under the CFAA regardless of client authorization (Correct answer)
- Legal because the client authorized it
- Legal if the PI obtains a Nevada court order retroactively
- Permissible under Nevada PI licensing rules
Correct answer: A federal crime under the CFAA regardless of client authorization
Accessing another person's email account without their direct authorization violates the CFAA; a client cannot grant authorization to access a third party's account.
PILB Digital Forensics and Cyber Investigations 1
A Nevada PI is asked to recover deleted files from a client's computer as part of a civil case.
The PI should: