Digital Forensics and Cyber Investigations Flashcards
6 cards from real PILB practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Digital Forensics and Cyber Investigations flashcards as text
IP address geolocation data obtained by a PI during a cyber investigation is best described as:
Answer: Circumstantial evidence that may approximate a device's location but is not conclusive proof of a subject's location
IP geolocation provides an approximate area based on ISP registration data but cannot definitively place a specific individual at a location.
A PI is retained to investigate a data breach affecting a Nevada business. Which action is outside the PI's lawful scope?
Answer: Hacking into the suspected attacker's system to retrieve stolen data
Unauthorized access to any computer system, even an attacker's, violates the CFAA and is outside the lawful authority of a PI.
Dark web monitoring by a Nevada PI for a client's exposed credentials is:
Answer: Permissible as long as it involves passive monitoring of publicly accessible dark web forums without unauthorized access
Passively monitoring publicly accessible dark web forums without attempting to access restricted systems is a lawful investigative technique.
When a PI collects digital evidence for litigation, the opposing party's attorney requests discovery of the PI's forensic methods. The PI should:
Answer: Be prepared to document and explain the forensic methodology used to ensure admissibility
Forensic methodology must be transparent and defensible in court; documented processes support the admissibility of digital evidence.
A Nevada PI uses spyware to secretly install tracking software on a subject's personal smartphone without consent. This action violates:
Answer: The CFAA, ECPA, and NRS 205.4765 (Nevada computer crimes statutes), and PILB ethical rules
Covert installation of spyware violates multiple federal and Nevada statutes and PILB ethics rules, regardless of the client's relationship to the subject.
After completing a digital forensics engagement, a Nevada PI should retain case files and digital evidence for a minimum of how long, per professional best practices and potential legal hold requirements?
Answer: At least 5 years, or as directed by the client's legal counsel or a litigation hold notice
Professional standards and potential litigation hold obligations require extended retention of case records; 5 years aligns with common legal and professional practice.