CFE-Investigation: Certified Fraud Examiner - Investigation Examination Practice Questions

When a fraud examiner is conducting an examination and is in the process of collecting documents, the fraud examiner should:

• AA. Wait until all documents have been collected before establishing a database
• BB. Organize all the documents obtained in chronological order
• CC. Avoid touching original documents any more than necessary
• DD. Make copies of originals and leave the originals where they were found

Which of the following is the LEAST accurate statement about seizing a computer for examination?

• AA. When taking a computer for examination, if the computer is off, it should remain off when it is removed.
• BB. When seizing a computer that is running, it is acceptable to review the files contained on the machine prior to seizing it.
• CC. When seizing a computer for examination the seizing party should look around the area for passwords because many people leave passwords near their computers.
• DD. Before removing a computer system from a scene for further analysis, it is important to document the system's setup with photographs or diagrams