ACFE CFE-Investigation Exam - Topic 4 Question 121 Discussion

Actual exam question for ACFE's CFE-Investigation exam

Question #: 121
Topic #: 4

Which of the following is the LEAST ACCURATE statement about seizing a computer for examination?

AWhen taking a computer for examination, if the computer is off. it should remain off when it is removed.

BWhen seizing a computer that is running, it is acceptable for a fraud examiner to review the files contained on the machine prior to seizing it.

CBefore removing a computer system from a scene for further analysis, it is important to document the system's setup with photographs or diagrams.

DWhen seizing a computer for examination, the seizing party should took around the area for passwords because many people leave passwords near their computers

Show Suggested Answer

Suggested Answer: B

The manual states:

''When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence.''

Thus, B is the least accurate statement.

by Alyce at Mar 06, 2026, 04:00 AM

Limited Time Offer

25%

1 month ago

I think option B might be the least accurate because I remember reading that you shouldn't access files before seizing the computer.

upvoted 0 times

...