Exam CFE - Investigation topic 1 question 35 discussion

Actual exam question from ACFE's CFE - Investigation

Question #: 35
Topic #: 1

Jackson, a digital forensic examiner for a government agency, is conducting a criminal investigation into the alleged embezzlement of funds from the government’s Welfare Department (WD). Ginny, a WD employee, is the prime suspect. Jackson obtains a court order authorizing him to seize Ginny’s personal computer for forensic examination. Which of the following is the MOST ACCURATE statement?

A. If Ginny’s computer is running, Jackson should perform a graceful shutdown by turning it off using the normal shutdown process.
B. If Ginny’s computer is off, Jackson should not turn it on unless he plans to use an encryption device that can guarantee that the system’s hard drive will not be accessed during startup.
C. If Ginny’s computer is running, Jackson may retrieve data from the computer directly via its normal interface is the evidence that he needs exists only in the form of volatile data.
D. If Ginny’s computer is off and Jackson needs evidence that exists only in the form of volatile data, he should turn the computer on and retrieve data directly via the computer’s normal interface.

Show Suggested Answer

Suggested Answer: A 🗳️

by raochavan at March 23, 2025, 3:18 a.m.

Comments

Submit Cancel

raochavan

3 weeks, 6 days ago

Selected Answer: B

Turning on a computer can change file access times and other metadata. If the hard drive contains encrypted data, turning it on will cause the system to attempt to decrypt and load the operating system, potentially altering evidence.

upvoted 1 times

...

Exam CFE - Investigation All Questions

View all questions & answers for the CFE - Investigation exam

Exam CFE - Investigation topic 1 question 35 discussion

Comments

raochavan

SY0-701