Digital Forensics, Cyber Fraud and Electronic Evidence

Introduction and Context

Accounting and fraud examination increasingly depend on evidence created, stored, transmitted, and altered through digital systems. A fraudulent payment may involve a compromised email account, a manipulated enterprise-resource-planning record, a stolen identity, a cryptocurrency wallet, or a cloud service hosted in another jurisdiction. Consequently, the forensic accountant must understand not only financial records but also the digital environments that create and preserve them.

Digital forensics is the disciplined identification, acquisition, preservation, examination, analysis, and presentation of information from digital devices and services. Its purpose is not simply to “find deleted files.” It is to establish what happened, when it happened, how it happened, who may have been involved, and whether the conclusions can withstand professional, regulatory, or judicial scrutiny.

Electronic evidence is information of potential evidential value that exists in digital form. It includes emails, attachments, system logs, databases, spreadsheets, browser histories, mobile messages, cloud audit trails, access-control records, metadata, transaction records, and data recovered from deleted or damaged media. Such evidence is powerful but fragile: it can be overwritten, remotely changed, encrypted, misinterpreted, or disconnected from its context.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain major forms of cyber-enabled fraud, payment fraud, and identity schemes.
2. Distinguish digital evidence, electronic evidence, metadata, and forensic artifacts.
3. Explain how email, logs, mobile devices, cloud platforms, and enterprise systems support fraud examinations.
4. Describe legally defensible evidence preservation, forensic imaging, hashing, chain of custody, and e-discovery.
5. Evaluate the reliability, limitations, and ethical implications of digital evidence.
6. Apply a structured forensic approach to an illustrative cyber-fraud investigation.

1. Cyber-Enabled Fraud

Cyber-enabled fraud is fraud in which digital technology facilitates, conceals, automates, or expands the misconduct. The underlying fraud may be familiar—misappropriation, false invoicing, identity theft, bribery, or money laundering—but technology increases speed, scale, reach, and concealment.

Common categories include:

• Business email compromise (BEC): An attacker impersonates or takes control of an executive, supplier, or employee account to induce payment or disclosure of information.
• Invoice and payment diversion: A legitimate invoice or supplier bank account is changed, often after a mailbox has been compromised.
• Payroll fraud: Payroll master data is altered so wages are redirected to an unauthorized account or fictitious employee.
• Credential theft: Passwords, authentication tokens, or session cookies are obtained through phishing, malware, credential-stuffing, or social engineering.
• Identity fraud: Personal or organizational identity information is used to open accounts, obtain credit, submit false claims, or authorize transactions.
• Ransomware-related fraud: Criminals encrypt systems, steal data, demand payment, or exploit the crisis to issue fraudulent instructions.
• Procurement and vendor fraud: Digital procurement records, vendor profiles, or approval workflows are manipulated.
• Cryptocurrency and digital-asset fraud: Wallets, exchanges, token offerings, or blockchain-based transactions are used in theft, investment scams, or laundering.

Technology does not eliminate the need to prove traditional fraud elements. An examiner must still connect the actor, conduct, intent, loss, and relevant circumstances. An IP address or login record may show that an account was used, but it does not automatically prove who operated it.

The fraud triangle in a digital environment

The fraud triangle—pressure, opportunity, and rationalization—remains useful. Digital systems can increase opportunity through excessive privileges, weak authentication, inadequate segregation of duties, poor vendor-change controls, and insufficient logging. A fourth factor, sometimes called capability, is particularly important in cyber fraud: the offender may require technical skill, access, authority, or knowledge of organizational processes.

A strong control environment therefore combines accounting controls with information-security controls. Examples include multi-factor authentication, independent verification of payment changes, role-based access, dual approval, anomaly monitoring, immutable logs, and rapid revocation of access after staff departure.

2. Payment and Identity Schemes

Payment diversion

A typical payment-diversion scheme follows this sequence:

1. The perpetrator obtains information about a pending transaction.
2. The perpetrator compromises or impersonates a mailbox or supplier.
3. A convincing request changes bank details or payment instructions.
4. An employee processes the change without independent verification.
5. Funds are transferred, rapidly dispersed, and sometimes converted into cryptocurrency or moved across borders.

The examination should compare the original and changed payment instructions, identify who requested and approved the change, inspect authentication and mailbox activity, trace the beneficiary account, and determine whether the organization followed its own verification policy.

Identity schemes

Identity fraud may involve a natural person, employee, supplier, customer, director, or entire organization. Relevant indicators include inconsistent addresses, duplicate tax or bank details, impossible travel patterns, unusual device fingerprints, mismatched identity documents, newly created email domains, and account activity outside normal working hours.

Identity evidence must be handled carefully. A name appearing in a database is not proof that the named person performed an act. Examiners should distinguish:

• Identity claim: what a person or system says the user is.
• Authentication evidence: how the system verified access, such as a password or token.
• Attribution evidence: evidence linking the activity to a particular individual.
• Authorization evidence: evidence that the person was permitted to perform the action.

These are different propositions. A valid login establishes authentication more readily than human attribution or authorization.

3. Digital Evidence and Its Characteristics

Digital evidence has several important characteristics:

• Volatility: Data in memory, active sessions, temporary files, and some logs may disappear quickly.
• Replicability: Exact copies can often be made without consuming the original information.
• Alterability: Dates, files, logs, and databases can be changed, sometimes without obvious visual signs.
• Context dependence: A data item may be misleading without time-zone, system, user, and application context.
• Distributed location: Relevant evidence may exist on a laptop, phone, email server, cloud platform, backup, and third-party service.
• Scale: Large data volumes require filtering, indexing, analytics, and defensible selection criteria.

Metadata

Metadata is data about data. Examples include a document’s creator, creation and modification timestamps, file size, revision history, camera model, GPS coordinates, email routing information, and cloud-sharing permissions. Metadata can help establish sequence and provenance, but it is not automatically reliable. Copying, synchronization, time-zone conversion, application behavior, or deliberate manipulation may change it.

Examiners should record the source, collection method, time zone, system clock condition, and any transformations applied to metadata. A document’s “last modified” time, for example, may reflect a later copy operation rather than the moment its substantive content was changed.

Hash values

A cryptographic hash is a calculated digest of digital content. If the same algorithm is applied to the same unchanged input, the resulting digest should be the same. Hashing supports integrity verification; it does not prove authorship, truth, or legality of collection.

For a file or image, the examiner may calculate a digest before and after transfer:

Here, D is the digital data, H is a specified cryptographic hash function, and h is the resulting digest. The comparison is meaningful only if the same algorithm, input, and processing conditions are used. Modern practice commonly records strong algorithms such as SHA-256, while older algorithms may be retained for compatibility but should not be treated as equally resistant to collision attacks.

4. Email and Log Evidence

Email evidence

Email examinations should consider the message body, attachments, headers, mailbox audit records, authentication events, forwarding rules, deleted items, and related endpoint evidence. Important header fields may include sender and recipient addresses, timestamps, message identifiers, routing information, and authentication results such as SPF, DKIM, and DMARC indicators. These controls help evaluate domain-level authenticity, but a legitimate account can still be compromised, and a technically authenticated message can still be fraudulent in content.

Questions for an email examination include:

• Was the message sent from the genuine account or merely made to appear genuine?
• Was the mailbox accessed from an unusual device, location, or time?
• Were forwarding rules or delegated permissions created?
• Did the message contain a changed bank account, urgent instruction, or unusual language?
• Do server logs corroborate the claimed sending time?
• Were attachments downloaded, altered, or executed?

Email timestamps must be normalized to a common time standard, usually Coordinated Universal Time (UTC), while retaining the original time zone. Apparent contradictions may disappear after accounting for daylight-saving rules, server locations, and clock drift.

Log evidence

Logs are chronological records generated by operating systems, applications, networks, security tools, databases, payment platforms, and cloud services. Examples include authentication logs, firewall logs, VPN logs, endpoint detection records, database audit trails, access-control logs, and transaction histories.

A useful log analysis asks:

1. What system generated the record?
2. What event does the record represent?
3. Is the clock synchronized and what time zone is used?
4. Can the record be altered by administrators or users?
5. Is retention complete for the relevant period?
6. Can the event be correlated with other independent sources?

Log absence is not necessarily proof that an event did not occur. Logging may have been disabled, retention may have expired, or the event may have occurred in a system not examined. Conversely, a log entry is not necessarily proof that a person performed an action; automated processes, shared accounts, malware, and stolen credentials can generate activity.

5. Mobile, Cloud, and Enterprise Sources

Mobile devices

Mobile phones may contain messages, email, photographs, location information, application databases, browser artifacts, contact records, authentication tokens, and cloud-synchronization data. Collection choices include a logical extraction, file-system extraction, or physical acquisition, depending on device type, operating system, security controls, available tools, and legal authority.

A device should be isolated from networks when appropriate to prevent remote wiping or synchronization, but isolation can also destroy volatile evidence or prevent lawful remote preservation. The examiner must document the decision. A powered-on device may contain valuable volatile information; powering it off may trigger encryption or lose memory contents. There is no universal procedure independent of circumstances.

Cloud sources

Cloud evidence may include provider audit logs, identity and access-management records, file versions, sharing links, administrative actions, API activity, retention settings, and e-discovery exports. The customer may not control the underlying infrastructure or physical location. Collection therefore requires attention to provider terms, service-level retention, legal process, tenant boundaries, and time-zone conventions.

Cloud data is often dynamic. An examiner should preserve relevant accounts and logs promptly, identify custodians and repositories, record export parameters, and obtain provider documentation describing the format and meaning of the extracted data.

Enterprise systems

Financial and operational systems may preserve more useful evidence than a suspect’s workstation. Relevant sources include general-ledger audit trails, ERP change logs, vendor-master records, payment files, approval workflows, identity directories, privileged-access records, database logs, and backup systems. Reconciliation among these sources can reveal whether a transaction was entered, approved, altered, exported, and settled as represented.

6. Forensic Imaging and Defensible Handling

Forensic imaging is the creation of a bit-for-bit or otherwise validated forensic copy of storage media. The objective is to examine a working copy while preserving the original as far as practicable. A write blocker may be used to prevent changes to a source drive during acquisition, although the exact method depends on the device and acquisition environment.

A defensible process normally includes:

1. Authority and scope: Identify legal authority, organizational authorization, custodians, systems, time period, and relevant allegations.
2. Initial documentation: Photograph or record device condition, serial numbers, power state, connections, date, time, and persons present.
3. Preservation: Prevent destruction or alteration, including legal holds, account preservation, network isolation, or suspension of automated deletion where appropriate.
4. Acquisition: Use validated tools and a documented method to create an image or targeted collection.
5. Integrity verification: Calculate and record hashes or other validation information.
6. Secure storage: Restrict access, preserve originals, and maintain backups in controlled environments.
7. Examination: Work from verified copies using repeatable procedures.
8. Analysis: Develop and test hypotheses, correlate sources, and distinguish facts from interpretations.
9. Reporting: Explain methods, limitations, findings, and the basis for each conclusion.

Chain of custody

Chain of custody is the chronological record of evidence possession and handling. It should identify the item, unique identifier, source, date and time, transferor, recipient, purpose, location, method, and integrity checks. A gap does not automatically make evidence unusable, but it creates a credibility and admissibility issue that must be explained and evaluated.

Evidence preservation versus evidence collection

Preservation prevents loss or alteration. Collection obtains a copy or extract for examination. These are related but distinct. A legal hold may preserve an email account, while a later forensic export collects relevant messages. Preservation should begin as soon as litigation, investigation, or regulatory review is reasonably anticipated.

7. E-Discovery and the Forensic Accountant

E-discovery is the managed process of identifying, preserving, collecting, processing, reviewing, and producing electronically stored information (ESI). It is broader than forensic imaging. E-discovery often focuses on relevant communications and business records across custodians and repositories, whereas a forensic investigation may require detailed examination of a device, system, or malicious process.

A proportional e-discovery workflow commonly includes:

• identifying custodians, systems, and date ranges;
• issuing a legal hold;
• collecting data in a manner that preserves relevant metadata;
• processing, de-duplicating, indexing, and filtering data;
• reviewing relevance, privilege, confidentiality, and responsiveness;
• applying redactions where justified;
• producing information in an agreed format; and
• documenting decisions and quality controls.

Keyword searches alone can miss relevant evidence because of misspellings, code words, images, encrypted files, or poor search design. Technology-assisted review, clustering, near-duplicate analysis, email threading, and predictive methods can improve efficiency, but human validation remains important. Artificial intelligence may prioritize documents or identify patterns; it should not be treated as an unexplained substitute for evidential judgment. The examiner must preserve the input data, prompts or settings where relevant, validation results, and limitations of the model.

8. A Structured Investigative Framework

A practical framework for a digital-fraud examination is the TRACE model:

• T—Trigger and authority: Define the allegation, mandate, legal basis, and scope.
• R—Risk and preservation: Identify volatile sources, affected systems, privacy risks, and preservation steps.
• A—Acquire and authenticate: Collect data using documented methods and verify integrity.
• C—Correlate and analyze: Compare independent sources, construct timelines, test hypotheses, and quantify loss.
• E—Explain and report: Present findings clearly, distinguish fact from inference, and disclose limitations.

The model is not a legal rule or a substitute for jurisdiction-specific standards. It is a practical organizing framework.

Timeline analysis

Timeline analysis is especially valuable in payment fraud. Events may be aligned by UTC and categorized as authentication, email, account change, approval, payment initiation, bank settlement, and funds movement. The timeline should preserve uncertainty. If a server clock was six minutes slow, the report should not present its timestamps as exact without qualification.

Hypothesis testing

Examiners should formulate competing explanations, such as:

• an employee intentionally changed the vendor account;
• an external attacker used stolen credentials;
• a legitimate administrator made an error; or
• an automated integration generated the change.

Evidence should be assessed against each explanation. This reduces confirmation bias and prevents an examiner from treating suspicious appearance as proof.

9. Illustrative Case: The Redirected Supplier Payment

The following is a fictional educational case.

Background

Northbridge Components, a medium-sized manufacturer, paid $248,600 to a supplier. Two days later, the supplier stated that it had not received the funds. The payment team produced an email requesting a change to the supplier’s bank account.

Problem

Management needed to determine whether the loss resulted from employee collusion, an external compromise, or a control failure; whether other payments were exposed; and what evidence could support recovery and reporting.

Analysis

The forensic team preserved the payment mailbox, the accounts-payable workstation, the ERP vendor record, identity-provider logs, email audit logs, and relevant bank records. The original supplier email was exported with headers and metadata. Investigators found that:

• the supplier’s bank-change request came from a look-alike domain differing by one character;
• a finance employee had received a phishing message three days earlier;
• the employee’s mailbox contained a new external forwarding rule;
• identity logs showed a successful login from an unfamiliar country followed by a legitimate-looking session;
• the ERP record was changed shortly after the mailbox event;
• the payment was approved by one authorized employee, contrary to the organization’s policy requiring telephone verification and dual approval; and
• the beneficiary account transferred most of the funds to other accounts within hours.

The evidence did not establish that the finance employee intentionally participated. It supported a conclusion that the mailbox credentials were probably compromised and that payment controls failed to detect or prevent the diversion. Bank records and account-opening information were then used to support recovery efforts and reporting to relevant authorities.

Approach and solution

The team created a normalized timeline, hashed collected exports, interviewed the employee without assuming guilt, searched for similar vendor changes, reset credentials, removed forwarding rules, and placed a hold on relevant cloud data. The organization required independent call-back verification using a trusted supplier contact, dual approval for bank changes, phishing-resistant multi-factor authentication for high-risk accounts, and alerts for external forwarding rules.

Outcome

A portion of the funds was frozen through rapid bank intervention. The investigation found two additional suspicious vendor-record changes that had not yet resulted in payment. The final report separated established facts, reasonable inferences, unresolved questions, and control recommendations.

Learning points

1. A convincing email is not reliable merely because it appears in an employee mailbox.
2. Account compromise, authentication, authorization, and human intent are separate issues.
3. Corroboration across email, identity, ERP, and banking evidence is stronger than reliance on one artifact.
4. Prompt preservation can be decisive because cloud logs and mailbox data may have limited retention.
5. Control design and forensic analysis are connected: poor verification procedures create opportunity.

10. Legal, Ethical, and Governance Considerations

Digital investigations must comply with applicable law, professional standards, privacy requirements, employment rules, contractual obligations, and court or regulatory procedures. Requirements differ by jurisdiction, especially for interception, employee monitoring, cross-border transfers, privileged communications, personal data, and cloud-hosted information.

Key principles include:

• Lawful authority: Obtain appropriate consent, mandate, warrant, order, or organizational authorization.
• Proportionality: Collect information reasonably related to the allegation and avoid unnecessary intrusion.
• Data minimization: Limit access and retention of irrelevant personal information.
• Independence: Avoid conflicts of interest and do not tailor conclusions to management expectations.
• Competence: Use trained personnel and validated methods.
• Transparency: Document assumptions, tool versions, filters, exclusions, and limitations.
• Confidentiality: Protect evidence from unauthorized disclosure.
• Fairness: Preserve potentially exculpatory evidence and avoid treating technical indicators as proof of culpability.

An examiner should never alter original evidence for convenience, speculate beyond the data, or present a probability as a fact without explaining its basis. Professional skepticism requires questioning both suspicious evidence and apparently exculpatory evidence.

11. Challenges and Limitations

Digital evidence is not infallible. Encryption may prevent access; malware may alter logs; shared accounts may defeat attribution; cloud providers may retain incomplete records; clocks may be unsynchronized; and deleted data may be unrecoverable. Hash verification proves that a copy matches a source at particular points in time, but it does not establish that the source was accurate or lawfully obtained.

Attribution is especially difficult. An IP address identifies a network endpoint or service relationship, not necessarily a person. A device may be shared, stolen, remotely controlled, or infected. Strong conclusions therefore rely on convergence: multiple independent artifacts that support the same explanation.

Volume is another limitation. Automated analytics can produce false positives, and the absence of a keyword does not prove absence of relevant conduct. Sampling, search terms, machine-learning classifiers, and review decisions must be validated against the purpose of the investigation.

12. Contemporary Developments and Best Practices

Current fraud examinations increasingly involve zero-trust architecture, phishing-resistant authentication, endpoint telemetry, software-as-a-service audit trails, collaboration platforms, digital wallets, deepfake-enabled impersonation, and generative-AI-assisted social engineering. Synthetic voice or video may increase the credibility of urgent payment requests, but the appropriate response remains process-based verification rather than attempting to detect every fake.

Organizations should:

1. maintain accurate asset, account, and data inventories;
2. enable centralized, tamper-resistant logging with suitable retention;
3. synchronize system clocks and document time zones;
4. use multi-factor authentication and least privilege;
5. separate vendor-master changes from payment approval;
6. verify payment changes through trusted, independent channels;
7. test backups and incident-response plans;
8. define legal-hold and evidence-preservation procedures;
9. train staff using realistic payment and identity scenarios; and
10. periodically test whether controls generate evidence sufficient for investigation.

Forensic accountants should develop competence in accounting systems, authentication concepts, data analytics, privacy, evidence handling, and communication with legal and technical specialists. They need not become penetration testers, but they must understand how digital systems generate evidence and where the boundaries of their expertise lie.

Chapter Summary

Cyber-enabled fraud combines traditional fraudulent objectives with digital tools that increase speed, scale, concealment, and reach. Major schemes include business email compromise, payment diversion, identity fraud, credential theft, payroll manipulation, ransomware-related fraud, and digital-asset abuse. Digital evidence includes emails, logs, metadata, databases, mobile artifacts, cloud records, and enterprise audit trails.

Reliable examination depends on lawful authority, prompt preservation, documented acquisition, forensic imaging or defensible targeted collection, integrity verification, secure storage, chain of custody, and transparent reporting. Hashes support integrity but do not prove authorship or truth. Email and log evidence must be interpreted in context, with attention to authentication, time zones, clock accuracy, retention, and alternative explanations. Mobile and cloud evidence require special attention to volatility, synchronization, provider control, privacy, and cross-border issues.

E-discovery manages electronically stored information across custodians and repositories, while forensic investigation may require deeper system-level analysis. The TRACE framework—trigger and authority, risk and preservation, acquire and authenticate, correlate and analyze, explain and report—provides a practical structure. Ultimately, defensible conclusions arise from corroborated evidence, tested hypotheses, professional skepticism, and respect for legal and ethical boundaries.

Key Terms

Digital forensics: The disciplined examination of digital information for investigative or evidential purposes.

Electronic evidence: Information of potential evidential value stored or transmitted in digital form.

Cyber-enabled fraud: Fraud facilitated, expanded, concealed, or automated through digital technology.

Business email compromise: Fraud involving impersonation or compromise of an email account to induce action or payment.

Metadata: Data describing characteristics, origin, history, or context of other data.

Hash: A calculated digital digest used to help verify data integrity.

Forensic image: A validated copy of digital storage made for examination.

Write blocker: A tool or method designed to prevent alteration of source storage during acquisition.

Chain of custody: The documented history of evidence possession, transfer, storage, and handling.

Volatile data: Information that may disappear or change when a system loses power or state.

Log: A chronological record generated by a system, application, network, or service.

Authentication: Verification of a claimed identity.

Authorization: Permission to perform an action or access a resource.

Attribution: Linking an action or event to a particular person or entity.

E-discovery: The process of managing electronically stored information for legal or regulatory purposes.

Legal hold: A direction to preserve potentially relevant information.

Custodian: A person or organizational unit controlling or possessing relevant information.

Least privilege: The security principle of granting only the access necessary for a legitimate function.

Technology-assisted review: Use of software or machine-learning methods to help classify or prioritize documents.

Review Questions

Short Answer Questions

1. What is cyber-enabled fraud, and how does it differ from fraud conducted without digital technology?
2. Why does a valid login not necessarily prove that a particular person performed an action?
3. What is metadata? Give three examples relevant to a fraud examination.
4. What is the purpose of calculating a hash during evidence acquisition?
5. Distinguish preservation from collection in an e-discovery process.

Long Answer Questions

1. Explain the main stages of a legally defensible digital-evidence process, from authority and preservation through reporting.
2. Discuss how email headers, mailbox audit logs, identity logs, and ERP records can be correlated in a payment-diversion investigation.
3. Compare the evidential opportunities and limitations of mobile-device evidence and cloud-platform evidence.
4. Explain why chain of custody, time normalization, and tool documentation affect the credibility of digital evidence.
5. Evaluate the role of artificial intelligence and technology-assisted review in e-discovery, including risks of overreliance.

Analytical / Application Questions

1. A supplier requests a bank-account change by email. The message passes domain-authentication checks, but the request uses urgency and is followed by a login from an unusual country. Design an investigation plan and identify the evidence you would preserve first.
2. An employee denies changing an ERP vendor record. Logs show the employee’s account performed the change, while endpoint records show malware activity. Develop at least three competing hypotheses and explain what evidence would distinguish them.
3. A company discovers that cloud audit logs for the relevant month are incomplete. Assess how this limitation affects the investigation and propose alternative sources for corroboration.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the evidential meaning of a hash value?

A. It proves who created the file.

B. It helps verify that data has remained unchanged between comparisons.

C. It proves that the file was lawfully collected.

D. It establishes the intention of the user.

Correct Answer: B. It helps verify that data has remained unchanged between comparisons.

Question 2

Which control most directly reduces payment-diversion risk when a supplier requests new bank details?

A. Accepting the request if the email passes SPF.

B. Relying on the employee who entered the change.

C. Independent verification through a trusted communication channel.

D. Deleting the original email after payment.

Correct Answer: C. Independent verification through a trusted communication channel.

Question 3

What is the principal purpose of a legal hold?

A. To preserve potentially relevant information.

B. To calculate a cryptographic hash.

C. To authorize every employee to access evidence.

D. To replace forensic acquisition.

Correct Answer: A. To preserve potentially relevant information.

Question 4

Which proposition is most accurately supported by an IP address?

A. The identity and intent of a specific person.

B. The physical location of the person beyond doubt.

C. A network endpoint or service relationship associated with activity.

D. The legal authorization of the activity.

Correct Answer: C. A network endpoint or service relationship associated with activity.

Question 5

Which item is an example of metadata?

A. A document’s revision timestamp and author field.

B. A verbal interview confession only.

C. A paper invoice unrelated to a digital system.

D. A future prediction about a transaction.

Correct Answer: A. A document’s revision timestamp and author field.

Question 6

Why should email timestamps be normalized during an investigation?

A. To remove all uncertainty from the evidence.

B. To account consistently for time zones and related clock differences.

C. To convert emails into paper records.

D. To prove that the sender was physically present.

Correct Answer: B. To account consistently for time zones and related clock differences.

Question 7

Which sequence best represents the TRACE framework in this chapter?

A. Transfer, Review, Archive, Copy, Erase.

B. Trigger and authority, Risk and preservation, Acquire and authenticate, Correlate and analyze, Explain and report.

C. Test, Recover, Audit, Calculate, Encrypt.

D. Triage, Report, Attribute, Certify, Execute.

Correct Answer: B. Trigger and authority, Risk and preservation, Acquire and authenticate, Correlate and analyze, Explain and report.

Question 8

What is a key limitation of a forensic image?

A. It can never be hashed.

B. It automatically proves the truth of every file it contains.

C. It may preserve data accurately without proving authorship or legal collection.

D. It cannot contain deleted-file artifacts.

Correct Answer: C. It may preserve data accurately without proving authorship or legal collection.

Question 9

Which evidence combination would most strongly support analysis of a redirected supplier payment?

A. Only the employee’s recollection.

B. Only the appearance of the email display name.

C. Email records, identity logs, ERP audit trails, and bank records considered together.

D. A single IP address without time information.

Correct Answer: C. Email records, identity logs, ERP audit trails, and bank records considered together.

Question 10

Which principle requires limiting collection and access to information reasonably related to the investigation?

A. Proportionality.

B. Collision resistance.

C. Redundancy.

D. Delegation.

Correct Answer: A. Proportionality.