Certified Fraud Examiner - Investigation Exam: CFE-INVESTIGATION

When a fraud examiner is conducting an examination and is in the process of collecting. documents the fraud examiner should:

A. A Wait until all documents have been collected before establishing a database

B. Organize all the documents obtained in chronological order

C. Avoid touching original documents any more than necessary

D. Make copies of originals and leave the originals where they were found

Which of the following is NOT a common use of public sources of information?

A. Obtaining an individual's credit records

B. Finding out about a person's lifestyle

C. Developing background information on a subject

D. Corroborating or refuting witness statements

Which of the following is the LEAST accurate statement about seeing a computer for examination?

A. When taking a computer for examination it the computer is off should remain off when It is removed.

B. When seizing a computer that is running, it is acceptable to review the files contained on the machine prior to seizing it.

C. When seizing a computer for examination the seizing party should look around the area for passwords because many people leave passwords near their computers.

D. Before removing a computer system from a scene for further analysis. It is important to document, the system's setup with photographs or diagrams