Discuss ACFE CFE-Investigation Exam Topic 4 Question 121

Which of the following is the LEAST ACCURATE statement about seizing a computer for examination?

AWhen taking a computer for examination, if the computer is off. it should remain off when it is removed.

BWhen seizing a computer that is running, it is acceptable for a fraud examiner to review the files contained on the machine prior to seizing it.

CBefore removing a computer system from a scene for further analysis, it is important to document the system's setup with photographs or diagrams.

DWhen seizing a computer for examination, the seizing party should took around the area for passwords because many people leave passwords near their computers

Suggested Answer: B

The manual states:

''When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence.''

Thus, B is the least accurate statement.

Get Premium CFE-Investigation Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

26 comments · newest first

Nichelle 2 months ago

D seems off too. Not all people leave passwords out.

Carmen 2 months ago

C makes sense. Documenting is crucial for integrity.

Alida 2 months ago

Agreed, B is risky. It could alter evidence.

Chauncey 2 months ago

I think B is the least accurate. You shouldn't review files before seizing.

Lenna 2 months ago

D seems off too. Not all people leave passwords out.

Michell 3 months ago

C makes sense. Documenting is crucial for accuracy.

Pete 3 months ago

Agreed, B is risky. It could alter evidence.

Janey 3 months ago

I think B is the least accurate. You shouldn't review files before seizing.

Marsha 3 months ago

D seems off too. Not all people leave passwords out.

Na 3 months ago

C is important too, but I feel A is misleading. Off means off, right?

Sue 3 months ago

Agreed, B is risky. It could alter evidence.

Gerald 4 months ago

I think B is the least accurate. You shouldn't review files before seizing.

Leota 4 months ago

I think D is a common misconception. Not everyone does that!

Ryan 4 months ago

A and C are solid practices, but D seems a bit sketchy.

Alaine 5 months ago

Wait, people actually leave passwords around? That's surprising!

Ludivina 6 months ago

Totally agree, B is a big no-no.

Tuyet 6 months ago

B is definitely the least accurate. You can't just browse files before seizing!

Marta 6 months ago

D) sounds a bit far-fetched. Who does that?

Dominga 6 months ago

Wait, people actually leave passwords around? That's surprising!

Tish 6 months ago

C) makes sense, documentation is key.

Evette 6 months ago

Totally agree, B) is a big no-no. You can't tamper with evidence.

Shala 7 months ago

A) is definitely the least accurate. You can't just leave it off!

Ty 7 months ago

I’m confused about option A; I thought it was okay to turn off a computer if it was running, but maybe it should stay off to avoid data loss?

Alaine 7 months ago

I practiced a similar question where documenting the setup was emphasized, so I think option C is definitely accurate.

Elly 7 months ago

I'm not entirely sure, but I feel like option D could also be misleading. It seems a bit unprofessional to just look for passwords lying around.

Krystal 7 months ago

I think option B might be the least accurate because I remember reading that you shouldn't access files before seizing the computer.

ACFE CFE-Investigation Exam - Topic 4 Question 121 Discussion