PILB Digital Forensics and Cyber Investigations

Question 1

A Nevada PI is asked to recover deleted files from a client's computer as part of a civil case. The PI should:

Accepted Answer

Use a forensic imaging tool to create a bit-for-bit copy before any analysis

Answer

Directly browse the hard drive to find deleted files

Answer

Reformat the drive to ensure a clean search

Answer

Ask the subject to recover the files themselves

Question 2

Which federal law prohibits unauthorized access to computer systems, making it relevant to cyber investigations conducted by Nevada PIs?

Accepted Answer

Computer Fraud and Abuse Act (CFAA)

Answer

Electronic Communications Privacy Act (ECPA)

Answer

Digital Millennium Copyright Act (DMCA)

Answer

Stored Communications Act (SCA)

Question 3

A PI is monitoring a suspect's social media activity for a client. To legally collect evidence from a public social media profile, the PI should:

Accepted Answer

Screenshot and archive publicly visible posts with timestamps using OSINT tools

Answer

Create a fake profile to befriend the subject and access private content

Answer

Hack into the subject's account to view private messages

Answer

File a subpoena to the social media company for all account data

Question 4

Chain of custody in digital evidence handling means:

Accepted Answer

Documenting every person who accessed or handled the evidence from collection to court presentation

Answer

Encrypting all digital files at rest

Answer

Storing evidence on multiple cloud platforms simultaneously

Answer

Allowing only the client to handle digital evidence

Question 5

When a Nevada PI collects metadata from a digital photograph as evidence, the metadata can reveal:

Accepted Answer

Date, time, GPS coordinates, and device information embedded in the file

Answer

Only the file name and size

Answer

The subject's Social Security number

Answer

The content of encrypted messages on the device

Question 6

A client provides a PI with login credentials to access a subject's email account to gather evidence. Accessing the account using these credentials is:

Accepted Answer

A federal crime under the CFAA regardless of client authorization

Answer

Legal because the client authorized it

Answer

Legal if the PI obtains a Nevada court order retroactively

Answer

Permissible under Nevada PI licensing rules