Question 1

Concealment investigative techniques do not work well in kickback situations. Why?

Accepted Answer

Concealment investigative techniques, such as tracing transactions and analyzing financial records, may not be effective in kickback situations as there is typically no direct evidence in the form of documented transactions. Kickbacks often involve illegal and unethical arrangements between two parties, and both may make efforts to hide the evidence of the transaction. Therefore, investigative techniques that rely on tracing such evidence may not yield results.

Question 2

What is used in court cases to prove that data has not been adversely affected during analysis?

Accepted Answer

Checksums are used to validate the integrity of data during analysis. They provide a unique digital signature for a set of data, and any changes made to the data will result in a different checksum value. This makes checksums an effective tool for detecting data tampering or corruption. Arithmetic mean and deviation measures are statistical tools used for data analysis but do not provide a means for validating data integrity. Random sampling is a technique used to select a representative subset of data for analysis but is not directly related to data integrity.

Question 3

Identify the first step in any electronic evidence collection process.

Accepted Answer

The first step in any electronic evidence collection process is to seize the device. This ensures that the device is secured and no data is destroyed or tampered with. Once the device is seized, further steps can be taken such as cloning the device or conducting a manual reconnaissance.

Question 4

Which of the following observations concerning physical evidence is true?

Accepted Answer

Physical evidence is more commonly associated with non-fraud types of crimes such as murder, theft, and assault. However, physical evidence can also be useful in fraud cases if there is evidence of the physical symptoms of fraud such as altered documents or forged signatures. Electronic sources of information can also be considered physical evidence if they are stored on physical devices such as hard drives or USB drives.

Question 5

Which investigative method is most useful after you have gathered other types of evidence and know who to interview and what questions to ask?

Accepted Answer

Once other types of evidence have been gathered and potential interviewees have been identified, the most useful investigative method is inquiry, which involves asking questions and seeking information from those interviewees. Theft, concealment, and conversion are not relevant in this context.

Question 6

Which of the following is a form of surveillance that is usually only available to law enforcement officers?

Accepted Answer

Wiretapping is typically only available with a warrant and is regulated by law. It involves intercepting and recording telephone conversations or electronic communications, and is therefore considered a more intrusive form of surveillance that is only available to law enforcement officers with legal authority. The other options listed can be used by individuals or organizations without the need for legal authorization.

Question 7

A divisional manager is suspected of adding ghost employees to the payroll. Which investigative method can most easily uncover this type of fraud?

Accepted Answer

Concealment involves examining records and documents to identify discrepancies or anomalies, such as ghost employees on the payroll.

Question 8

Electronic surveillance may have only limited value in the investigation of employee frauds and many other white- collar crimes. Why?

Accepted Answer

Electronic surveillance may raise concerns regarding employees' privacy, which may result in legal challenges that can prevent the use of the evidence in court. Additionally, many white-collar crimes involve the manipulation of financial data or documents, which may not be detectable through electronic means.

Question 9

Which of the following are theft act investigation methods that usually involve observing or listening to potential perpetrators?

Accepted Answer

Surveillance and covert operations involve observing or listening to potential perpetrators in order to gather evidence of theft or other criminal activity. Audits, online resources, and document examination typically involve analyzing records or data rather than direct observation of individuals.

Question 10

For fraud to occur, usually three elements are necessary: pressure, opportunity, and:

Accepted Answer

The three elements necessary for fraud to occur are pressure, opportunity, and rationalization. Pressure is the motivation for committing fraud, opportunity refers to the ability to do so, and rationalization is the justification or excuse for the fraudulent behavior. Money may be a motivator for fraud, but it falls under the category of pressure. Excitement and guidance are not typically necessary for fraud to occur.

Question 11

Which general term refers to the gathering of electronic evidence?

Accepted Answer

Computer forensics refers to the gathering and analyzing of electronic evidence for use in legal proceedings. Options A, B, and C are not related to electronic evidence gathering.

Question 12

Which investigation technique usually does not work well in kickback situations?

Accepted Answer

The answer of Which investigation technique usually does not work...

Question 13

The two primary checksum methods used today are:

Accepted Answer

MD5 and SHA-1 are both widely used and strong cryptographic hash functions that can be used for data integrity and authentication purposes. E-TTL and SSFDC are not related to checksum methods, and RS-232 is a communication protocol, not a checksum method. SDHC is a type of memory card and not a checksum method.

Question 14

Which checksum method is considered more advanced and secure than the method it replaced?

Accepted Answer

SHA-1 is considered more advanced and secure than the previous method, MD5. SHA-1 produces a larger hash length and is more resistant to attacks such as collisions. CRC-1 and CRC-2 are not considered secure checksum methods as they are more commonly used for error detection rather than security purposes.

Question 15

Which step in the electronic evidence collection process is important to ensure that the original disk is kept in its seized state?

Accepted Answer

Cloning is the process of making an exact copy of the original disk, ensuring that the original disk remains untouched and in its seized state. This is important for the integrity of the evidence and to avoid any allegations of tampering or alteration.

Question 16

Which of the following is a basic objective of surveillance, whether manual or electronic?

Accepted Answer

The basic objective of surveillance, whether manual or electronic, is to catch fraud at the theft act stage. This means that the surveillance is designed to detect a fraud when it is actually happening, in order to prevent any further losses from occurring. While analyzing how the money comes back in the form of assets, understanding the cover-up or concealment of fraud, and identifying victims of the fraud are all important objectives of fraud detection and prevention, catching fraud at the theft act stage is the most basic and foundational objective of any surveillance program.

Question 17

Which of the following is important regarding invigilation?

Accepted Answer

The answer of Which of the following is important regarding...

Question 18

Which of the following is NOT a component of a vulnerability chart?

Accepted Answer

The identification of the suspected perpetrator is not a component of a vulnerability chart. Vulnerability charts typically include a listing of assets, potential vulnerabilities or weaknesses, internal controls that have been compromised or are lacking, and possible attack scenarios. The purpose of a vulnerability chart is to identify areas of weakness that need to be addressed to reduce the risk of a successful attack. While identifying a perpetrator may be important for taking legal action after an attack has occurred, it is not directly relevant to identifying and managing vulnerabilities.

Question 19

What is the term for a calculation (using encryption technologies) based on the contents of a disk or file that are engineered so that even small changes in the source data will produce significantly different checksum results?

Accepted Answer

The term for a calculation (using encryption technologies) based on the contents of a disk or file that are engineered so that even small changes in the source data will produce significantly different checksum results is known as a cyclic redundancy check number or CRC. This is a common technique used to detect errors in data transmission or storage by applying a mathematical algorithm to the data that creates a unique checksum. If any of the data is corrupted or changed, the resulting checksum will be different, indicating an error.

Question 20

What usually dictates which of the four common ways frauds are investigated is utilized?

Accepted Answer

The specific type of fraud committed typically dictates which investigation method is utilized. Different types of fraud require different approaches and expertise, so investigators need to select the most appropriate method based on the specific circumstances of the case. For example, a financial fraud investigation might require forensic accounting skills, while an employee theft investigation might require surveillance or interviews.

Quiz 7: Investigating Theft Acts