CFE – Investigation — Question 48

Which of the following is NOT a step a fraud examiner must take before seizing evidence in a digital forensic investigation?

Answer options

• A. Determine whether there are privacy issues related to the item(s) to be searched.
• B. Ensure that only trained professionals employ any software used in a forensic capacity.
• C. Obtain and become familiar with any legal orders that apply to the investigation.
• D. Assemble an investigation team comprised only of outside digital forensic experts.

Correct answer: C

Explanation

The correct answer is C because understanding legal orders is essential for conducting a proper investigation. Options A and B represent necessary precautions regarding privacy and software use, while D is incorrect as it suggests limiting the team to only outside experts, which is not a requirement.