ACI Professional Ethics & Standards 2 — Questions and Answers
Question 1: An investigator discovers evidence during a civil case that suggests the subject committed an unrelated federal crime. What is the most ethically appropriate immediate action?
- Delete the evidence to stay within scope
- Report findings to supervising counsel and let legal determine next steps (Correct answer)
- Immediately contact federal law enforcement independently
- Ignore the evidence since it is outside the investigation scope
Correct answer: Report findings to supervising counsel and let legal determine next steps
Investigators should report out-of-scope findings to supervising counsel rather than acting unilaterally, as legal obligations vary by jurisdiction and context.
Question 2: Which principle requires a digital forensic investigator to present findings that are unfavorable to the retaining party if they are factually accurate?
- Advocacy
- Impartiality (Correct answer)
- Confidentiality
- Proportionality
Correct answer: Impartiality
Impartiality requires investigators to report all accurate findings regardless of which party retained them.
Question 3: A forensic examiner is asked by their employer to alter timestamps in a report to make evidence appear more recent. The correct ethical response is to:
- Comply since employers direct the work
- Refuse and document the request (Correct answer)
- Alter only minor timestamps that won't affect the case outcome
- Ask a colleague to do it instead
Correct answer: Refuse and document the request
Falsifying evidence is illegal and unethical; the examiner must refuse and document the request to protect themselves.
Question 4: Which document formally establishes the boundaries and permissions granted to a digital investigator before an examination begins?
- Chain of custody form
- Expert witness affidavit
- Authorization to examine (scope agreement or search warrant) (Correct answer)
- Incident response plan
Correct answer: Authorization to examine (scope agreement or search warrant)
A scope agreement, search warrant, or equivalent authorization defines exactly what the investigator is permitted to access and examine.
Question 5: An investigator finds child exploitation material while conducting a corporate fraud examination. What is the mandatory ethical and legal obligation?
- Preserve it as corporate evidence and continue the fraud investigation
- Report it immediately to law enforcement per mandatory reporting laws (Correct answer)
- Quarantine the device and await further corporate instructions
- Delete it to protect the organization from liability
Correct answer: Report it immediately to law enforcement per mandatory reporting laws
Child exploitation material triggers mandatory reporting laws (e.g., NCMEC CyberTipline requirement) that override all other investigative priorities.
Question 6: The concept of 'minimization' in digital forensic ethics refers to:
- Reducing the file sizes of forensic images
- Limiting access to and collection of data beyond what is legally authorized (Correct answer)
- Minimizing the time spent on examinations
- Reducing the cost of forensic services
Correct answer: Limiting access to and collection of data beyond what is legally authorized
Minimization requires investigators to collect only data within the authorized scope and avoid unnecessarily accessing private information.
Question 7: When an investigator testifies as a fact witness rather than an expert witness, they are limited to:
- Offering opinions about industry best practices
- Testifying only about what they personally observed or did (Correct answer)
- Drawing conclusions from the evidence they analyzed
- Explaining complex technical concepts to the jury
Correct answer: Testifying only about what they personally observed or did
A fact witness may only testify about direct personal observations and actions, unlike an expert witness who may offer opinions.
ACI Professional Ethics & Standards 2
An investigator discovers evidence during a civil case that suggests the subject committed an unrelated federal crime.
What is the most ethically appropriate immediate action?