ACFE Exam CFE-Investigation Topic 1 Question 89 Discussion

Actual exam question for ACFE's CFE-Investigation exam

Question #: 89
Topic #: 1

Which of the following is the MOST ACCURATE statement regarding the analysis phase in digital forensic investigations?

AThe analysis phase of digital forensic investigations should not commence unless it is verified that the suspect devices do not contain relevant data.

BDuring the analysis phase, it is best to use a combination of the various forensic tools that can assist h identifying, extracting, and collecting digital evidence

CWhen analyzing data for evidence, fraud examiners should look for exculpatory evidence but not exculpatory evidence

DThe primary concern when analyzing digital evidence is to protect the collected information from seizure

Show Suggested Answer

Suggested Answer: B

by My at Jun 23, 2024, 07:42 PM

Limited Time Offer

25%

Off

Get Premium CFE-Investigation Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Herman

7 months ago

Option A is a non-starter. How can you analyze the data if you don't even know if it's relevant?

upvoted 0 times

...

Theodora

7 months ago

Haha, option C is like 'Look for the bad stuff, but ignore the good stuff.' Might as well just flip a coin while you're at it.

upvoted 0 times

Ruthann

5 months ago

Flo: Definitely, it's important to be thorough in the analysis phase.

upvoted 0 times

...

Flo

5 months ago

Yeah, using a combination of tools can help ensure all relevant evidence is collected.

upvoted 0 times

...

Selma

5 months ago

Option B seems like the most practical approach.

upvoted 0 times

...

Mauricio

5 months ago

Yeah, option C doesn't make much sense. We should definitely consider all evidence.

upvoted 0 times

...

Nelida

6 months ago

I agree, using a combination of tools can help ensure a thorough analysis.

upvoted 0 times

...

Demetra

7 months ago

Option B seems like the most practical approach to me.

upvoted 0 times

...

Gabriele

7 months ago

Option D is just plain silly. The primary concern should be preserving the integrity of the digital evidence, not protecting it from seizure.

upvoted 0 times

Katlyn

7 months ago

Definitely, that should be the main focus during the analysis phase.

upvoted 0 times

...

Portia

7 months ago

I agree, preserving the integrity of the digital evidence is crucial.

upvoted 0 times

...

Felix

8 months ago

I disagree with Mira, the answer is A because verifying suspect devices is the first step in analysis.

upvoted 0 times

...

Mira

8 months ago

I believe the answer is D, protecting the collected information is crucial.

upvoted 0 times

...

Lorriane

8 months ago

I'm not sure about option C - shouldn't fraud examiners be looking for both incriminating and exculpatory evidence?

upvoted 0 times

Herschel

7 months ago

I agree. It's important to consider all types of evidence during the analysis phase.

upvoted 0 times

...

Floyd

7 months ago

Option C is incorrect. Fraud examiners should definitely look for both incriminating and exculpatory evidence.

upvoted 0 times

...

Yaeko

8 months ago

Option B seems like the most comprehensive approach to the analysis phase. Using a variety of forensic tools can help uncover different types of digital evidence.

upvoted 0 times