ADC ADC Compliance & Regulatory Standards 2 — Questions and Answers
Question 1: What does the Electronic Communications Privacy Act (ECPA) govern in the context of digital forensics?
- Physical evidence handling procedures
- The interception and disclosure of electronic communications and stored data (Correct answer)
- Forensic lab certification standards
- Encryption key escrow requirements
Correct answer: The interception and disclosure of electronic communications and stored data
ECPA regulates government and private access to stored electronic communications and real-time interceptions, defining when a warrant or subpoena is required.
Question 2: Under FRCP Rule 26, what are parties required to disclose regarding electronically stored information (ESI)?
- Encryption keys for all digital evidence
- The sources, formats, and location of ESI that may be used as evidence (Correct answer)
- Expert witness qualifications only
- Physical server hardware specifications
Correct answer: The sources, formats, and location of ESI that may be used as evidence
FRCP Rule 26 requires early disclosure of ESI sources so opposing parties can assess the scope and negotiate collection and production procedures.
Question 3: What is the primary purpose of a legal hold notice in a US litigation context involving digital evidence?
- To authorize forensic examination of evidence
- To notify relevant parties to preserve potentially relevant ESI from destruction (Correct answer)
- To request court-ordered decryption
- To transfer evidence custody to law enforcement
Correct answer: To notify relevant parties to preserve potentially relevant ESI from destruction
A legal hold suspends routine document destruction policies and obligates custodians to preserve ESI that may be relevant to anticipated or ongoing litigation.
Question 4: Which US privacy law most directly affects forensic investigations involving consumer financial records?
- COPPA
- Gramm-Leach-Bliley Act (GLBA) (Correct answer)
- CAN-SPAM Act
- Americans with Disabilities Act
Correct answer: Gramm-Leach-Bliley Act (GLBA)
The GLBA Safeguards Rule requires financial institutions to implement security controls protecting customer financial data, making its audit logs critical forensic evidence.
Question 5: In AccessData FTK case management, what feature helps document examiner actions for compliance audit purposes?
- The hash database export
- The case audit log that records all examiner activities and changes (Correct answer)
- The email threading module
- The registry viewer timestamps
Correct answer: The case audit log that records all examiner activities and changes
FTK's internal audit log creates a timestamped record of examiner actions within the case, supporting defensibility and chain-of-custody documentation.
Question 6: What does FRE Rule 902(13) allow regarding digital evidence authentication in US federal courts?
- Admission of evidence without any authentication
- Self-authentication of certified electronic records through hash value verification (Correct answer)
- Automatic admissibility of all digital forensic reports
- Authentication by any sworn officer
Correct answer: Self-authentication of certified electronic records through hash value verification
FRE 902(13) allows a certified person to attest that a hash value confirms the integrity of an electronic record, enabling self-authentication without a live witness.
ADC ADC Compliance & Regulatory Standards 2
What does the Electronic Communications Privacy Act (ECPA) govern in the context of digital forensics?