CFE Exam Quiz 35

Individuals who specialize in identifying, recovering, collecting, preserving, processing, and producing digital data for use in investigations and litigation are known as digital forensic experts. Fraud examiners would determine whether a digital forensic expert is needed when conducting an examination involving computers.

A peripheral device is an auxiliary device that is connected to, but not part of, a host computer. Peripheral devices include printers, fax machines, copiers, scanners, and storage devices. As data moves to and from peripheral devices, it leaves evidence of its presence and sometimes leaves full copies of its contents.

Printers might contain valuable evidence. Many printers have internal hard drives that could contain information relevant to a fraud examination. Generally, any information sent to and stored by a printer is recoverable unless the printer has overwritten the data.

Cloud storage refers to information stored by a third-party host that is accessible online. The cloud is a metaphor for the storage and utilization of data online rather than locally.

Cloud computing offers numerous benefits. These benefits include the following:

– The cloud can provide savings on hardware, software, or licensing fees.
– Cloud services offer a cost-effective alternative to building out IT infrastructure.
– The cloud improves accessibility because users can access the cloud anytime and anywhere.
– With cloud computing, organizations can easily scale information technology resources up or down to suit their business needs.

Virtually anything that can be stored on a hard drive can be uploaded to the cloud. Accordingly, information relevant to a fraud examination might be stored in the cloud. Fraudsters might save records or other key evidence to cloud storage in order to avoid possessing a copy on their own storage devices, therefore, fraud examiners would need to search these places, if possible.

Determining whether a subject uses cloud storage can be done by searching for payments made to cloud services, browser history (for types of cloud storage accessed via browsers), smartphone applications linked to cloud services, or making a request through discovery in litigation.

Investigations involving computer forensics typically involve the following phases: Planning, seizing, imaging, processing, analyzing, reporting and testifying.

Before the fraud examiner can seize evidence, he must take certain steps to help ensure that the evidence will be admissible. These steps involved in the planning phase of investigations involving computers include:

– Determining whether there are any privacy interests in the item(s) to be searched.
– Making appropriate preparations if the investigation involves the use of a legal order.
– Ensuring that all equipment used in a forensic capacity is legitimate and reliable.
– Ensuring that the fraud examiner is properly trained to employ relevant digital forensic tools.
– Ensuring that equipment is employed in the manner for which it was designed.

Fraud examination refers to a process of resolving allegations of fraud from inception to disposition. Fraud examination is the primary function of the anti-fraud professional. Fraud examinations are conducted to determine if fraud has occurred and if so to gather evidence of the crime.

The fraud examination process involves a variety of tasks. These tasks include:

– Obtaining evidence.
– Taking statements and writing reports.
– Testifying to findings.
– Assisting in the detection and prevention of fraud.

The portion of the cognitive interview in which the investigator seeks to track down who was involved and obtain specific details about the suspect is known as the specific-detail phase. In this phase, the investigator seeks to get additional information about the event by asking the witness to describe the suspect with specific details.

A non-dictated writing sample includes materials that are written by the individual during the everyday course of business. Non-dictated writing tends to reveal an individual’s normal writing habits.

The steps that an organization takes to instruct employees not to delete or destroy potentially relevant records to a new or imminent legal case is known as a litigation hold. Litigation hold procedures are necessary to ensure that potentially responsive documents are not destroyed once evidence of misconduct arises.

The form that documents the fact that permission was given to the fraud examiner by an individual to record specific conversations is known as the consent to record form. The consent to record form must be signed and witnessed.

Documents that a governmental agency is required to keep by law or that are necessary to discharge the duties imposed by law are known as public records. Public records can be accessed by the general public and therefore, are available to anyone who wishes to use them.

Once a fraud examiner has basic information about the subject, he can use it to search public records and gain information to trace the transactions. He can gather relevant information from various sources including online sources, government agency databases, public databases, and the use of other special investigative techniques. Some techniques might not require legal authorization (e.g., physical surveillance or witness interviews), while others might (e.g., electronic surveillance, search and seizure orders, legal orders to produce information, or account monitoring orders).

Chronemic communication is the use of time in nonverbal communication and interpersonal relationships to convey meaning, attitudes, and desires. Chronemics is a type of communication where time is used as a message system, including punctuality, amount of time spent with another, and waiting time.

The silent probe is a technique that involves just remaining quiet and waiting for a respondent to continue. The silent probe sometimes produces more information than direct questioning does.

Kinetic communication involves the use of body movement to convey meaning. Interviewers tend to focus attention on the face. Interviewers are more accurate in their judgments of others if they can see facial movements and expressions.

An outline of the course of action the team members expect to take throughout the fraud investigation is called a case plan. Establishing a case plan helps the team stay on track and focus on the key issues.

A chronological investigation is divided into time-based phases that, when completed, are marked as milestones. A chronological structure is best suited for investigations where time sequence is essential in organizing tasks.

Alibi documents suddenly appear “from out of nowhere,” and they often appear late in the course of an investigation, inquiry, or trial. They are always favorable to the suspect and refute previously developed information or evidence that is damaging to the suspect. Alibi documents are often fabricated.

Often, to add credibility to forged documents, fraudsters backdate them. Items located at a time when they could not have existed or occurred are referred to as anachronisms. To determine whether contemporary documents were backdated, experts usually rely on diligent investigation and forensic document examiners.

An interviewer could use body language to create the impression of trust during the interview by gesturing openly with the arms, clasping hands together, and leaning forward in a manner to indicate interest.

The most common method of marking evidence is with the date and initials of the person obtaining it. To aid later easy identification of evidence, all Evidence received is normally marked.

Evidence of fraud is usually obtained in different forms. Evidence of fraud can come in the form of documents, physical evidence, or in the form of statements by witnesses.

The short form engagement letter is the form of an engagement letter that does not spell out the details of what examination techniques the fraud examiner intends to follow.

Operating and file system experts are proficient in certain operating systems and the various file systems they employ. Operating and file systems experts also have the ability to convey operational characteristics and observe artifacts.

Backup solutions archive data in proprietary formats, making extraction very cumbersome. Experts that specialize in extracting information from tapes, digital media, or other system backups are referred to as recording and archival extraction experts.