CCE Legal & Ethical Issues in Digital Forensics 2 — Questions and Answers
Question 1: Under the Fourth Amendment, which standard must law enforcement meet to obtain a warrant for digital evidence?
- Reasonable suspicion
- Probable cause (Correct answer)
- Preponderance of evidence
- Clear and convincing evidence
Correct answer: Probable cause
The Fourth Amendment requires probable cause supported by oath or affirmation before a warrant can be issued.
Question 2: Which federal law specifically prohibits unauthorized interception of electronic communications?
- Computer Fraud and Abuse Act
- Electronic Communications Privacy Act (Correct answer)
- Stored Communications Act
- USA PATRIOT Act
Correct answer: Electronic Communications Privacy Act
The Electronic Communications Privacy Act (ECPA) of 1986 prohibits unauthorized interception of wire, oral, and electronic communications.
Question 3: A forensic examiner discovers child exploitation material during an authorized corporate investigation. What is the FIRST required action?
- Delete the material immediately
- Notify corporate HR
- Report to law enforcement and preserve evidence (Correct answer)
- Inform the suspect
Correct answer: Report to law enforcement and preserve evidence
Mandatory reporting laws require immediate notification to law enforcement, and evidence must be preserved per legal obligations.
Question 4: The 'plain view' doctrine in digital forensics allows examiners to:
- Search any file on a seized device
- Seize evidence found in plain sight during a lawful search (Correct answer)
- Expand the scope of a warrant automatically
- Share findings with third parties without authorization
Correct answer: Seize evidence found in plain sight during a lawful search
The plain view doctrine permits seizure of evidence that is immediately apparent and observed during a lawful search.
Question 5: Which privacy law governs the handling of student educational records and may impact a digital forensics investigation at a school?
- HIPAA
- COPPA
- FERPA (Correct answer)
- GLBA
Correct answer: FERPA
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records and restricts disclosure.
Question 6: What is 'chain of custody' documentation primarily designed to ensure?
- That evidence is collected quickly
- That evidence integrity and handling history are verifiable in court (Correct answer)
- That suspects are notified of seizure
- That backups are created before analysis
Correct answer: That evidence integrity and handling history are verifiable in court
Chain of custody documents every person who handled evidence and all actions taken, ensuring its integrity is defensible in court.
Question 7: A private employer wants to monitor employee emails on company systems. Which statement is MOST accurate legally?
- Employers can never monitor employee communications
- Employers generally may monitor company systems if employees have been notified (Correct answer)
- A warrant is required before any employer monitoring
- Employee consent is never needed for monitoring
Correct answer: Employers generally may monitor company systems if employees have been notified
Employers generally have the right to monitor company-owned systems, especially when employees are notified through acceptable use policies.
CCE Legal & Ethical Issues in Digital Forensics 2
Under the Fourth Amendment, which standard must law enforcement meet to obtain a warrant for digital evidence?