Why is it necessary to image a seized computer ' s hard drive for forensic analysis?

• A.To prohibit access to the suspect computer ' s hard drive by individuals not professionally trained in forensic analysis
• B.To allow for the analysis of data from a suspect computer without altering or damaging the original data in any way
• C.To create pictures of the suspect computer system and its wires and cables
• D.To enable the retrieval of data from the suspect computer directly via its operating system

Comment: *

Name: *

Email: *

Verification: *

In jurisdictions that allow for corporate criminal liability, which of the following elements is typically required for the corporation to be vicariously liable for the acts of one of its employees?

• A.The employee was acting within the scope of their employment.
• B.The employee who committed each element of a criminal offense was a member of management.
• C.The employee committed the offense with the intention of personal benefit.
• D.The employee was acting at the direction of someone in management or with their knowledge.

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements is MOST ACCURATE regarding covert operations?

• A.Covert operations rarely result in irreparable damage to an investigation, even when an investigator fails to plan properly or take appropriate precautions.
• B.Although covert operations can be beneficial to an investigation, mistakes made during the investigation can result in physical harm to the investigator.
• C.Most jurisdictions provide protections for investigators conducting covert operations so that they do not incur reputational, financial, or legal consequences.
• D.For best results, fraud examiners should conduct covert operations at the same time that they are pursuing conventional methods of gathering evidence.

Comment: *

Name: *

Email: *

Verification: *

An attorney hires a fraud examiner to work on an embezzlement case. In connection with the case, the attorney emails the fraud examiner a copy of a memorandum that is protected by a legal professional privilege. Which of the following statements is most accurate?

• A.The attorney did not waive the privilege because the legal professional privilege belongs to the client, not the attorney.
• B.The attorney did not waive the privilege because the attorney hired the fraud examiner to work on the case.
• C.The attorney waived the privilege because they transmitted the protected information to a third party.
• D.The attorney waived the privilege because they used email to transmit the protected information.

Comment: *

Name: *

Email: *

Verification: *

In systems using adversarial processes, an attorney may impeach an opposing party ' s witness by showing that the witness:

• A.Has a keen ability to observe
• B.Made poor consistent statements
• C.Testified from personal knowledge
• D.Is influenced by bias or self-interest

Comment: *

Name: *

Email: *

Verification: *