Evidence and Legal Systems Flashcards

When examining digital evidence in a fraud case, what is the first critical step a forensic examiner should take upon receiving a digital device?

Answer: Create a forensic bit-for-bit image of the original media

Creating a verified forensic image (bit-for-bit copy) preserves the original evidence, allows analysis without risk of altering the original, and supports chain of custody.

Under the Federal Rules of Civil Procedure, what term describes the pre-trial process requiring parties to disclose electronically stored information relevant to the case?

Answer: Electronic discovery (e-discovery)

Electronic discovery (e-discovery) governs the identification, preservation, collection, and production of electronically stored information during litigation under FRCP Rule 26.

Which type of documentary evidence in a fraud case is most likely to be challenged on authentication grounds?

Answer: Printed screenshots of email conversations

Printed screenshots are easily manipulated and lack inherent authentication markers, making them more vulnerable to challenges than documents obtained directly from authoritative sources.

In a fraud investigation, 'metadata' from electronic documents can be valuable primarily because it reveals what information?

Answer: Data about when a file was created, modified, and by whom

Metadata (data about data) embedded in electronic files can reveal creation dates, modification history, author names, and version history — often crucial for detecting document fraud or backdating.

A fraud examiner needs to obtain bank records from a financial institution without tipping off the suspect. Which legal mechanism is most appropriate in a civil investigation?

Answer: Civil subpoena duces tecum

A civil subpoena duces tecum compels third-party institutions to produce records in civil proceedings and can be served directly on the bank without notifying the suspect.

The 'best evidence' of a wire transfer in a fraud case would typically be which of the following?

Answer: The bank's certified records of the wire transaction

Certified bank records obtained directly from the financial institution constitute the best evidence of a wire transfer's details, with proper foundation and authentication.

When a fraud examiner analyzes financial statements, which accounting concept describes the requirement that transactions be recorded in the period they occur, regardless of when cash changes hands?

Answer: Accrual basis accounting

Accrual accounting records revenues when earned and expenses when incurred regardless of cash flow, and manipulating accruals is a common method of financial statement fraud.