Analyzing Evidence

Question 1

Ashton, a digital forensic examiner for Cadence Irrigation, is conducting an internal investigation into the alleged theft of trade secrets from Cadence. Kirby, a Cadence employee, is the prime suspect. Ashton decides to seize Kirby’s work computer for forensic examination. If, at the time of seizure, Kirby’s computer is off, then Ashton should turn it on before seizing it.

A. True
B. False

Answer 1

B. False

See pages 3.818 in the Fraud Examiner’s Manual

A computer system that is off should not be turned on during the seizure process. Turning on a system might damage and taint any evidence that it contains.

Question 2

Which of the following is an example of a data analysis function that can be performed to help detect fraud through examination of fixed asset accounts?

A. Compare book and tax depreciation and indicate variances
B. Recalculate expense and reserve amounts using replacement costs
C. Select samples for asset existence verification
D. All of the above

Answer 2

D. All of the above

See pages 3.730 in the Fraud Examiner’s Manual

The following are examples of data analysis queries that can be performed by data analysis software on fixed asset accounts to help detect fraud:

• Generate depreciation to cost reports.
• Compare book and tax depreciation and indicate variances.
• Sort asset values by asset type or monetary amount.
• Select samples for asset existence verification.
• Recalculate expense and reserve/provision amounts using replacement costs.

Question 3

A fraud examiner discovers a paper document believed to include both the suspect’s indented writings and latent fingerprints. Which of the following is the BEST preservation method to use when collecting the document?

A. Insert the document into a plastic bag using a pair of tweezers.
B. Put the document in a briefcase for analysis at a later time.
C. Leave the document in place for a forensic document examiner to collect later.
D. Place the document into a sealable, acid-free paper envelope while handling it with protective gloves.

Answer 3

D. Place the document into a sealable, acid-free paper envelope while handling it with protective gloves.

See pages 3.224-3.225 in the Fraud Examiner’s Manual

Fraud examiners should preserve evidentiary documents that contain latent fingerprints by placing them into labeled protective containers, such as sealable, acid-free paper envelopes. Many types of paper and plastic containers can leach acids that damage originals over long periods of storage. While some plastic containers, such as those made of polyethylene or polypropylene, do not leach acid, they might cause harmful condensation to develop on the document. To avoid smudging and contamination of the fingerprints, fraud examiners should wear protective gloves or carefully use tweezers when handling latent fingerprint evidence. However, tweezers should not be used on documents if indented writing or photocopier examinations are planned.

Question 4

A fraud examiner is conducting textual analytics on journal entry data and runs a keyword search using the terms override, write off, and reserve/provision. With which component of the Fraud Triangle are these fraud keywords typically associated?

A. Capability
B. Opportunity
C. Rationalization
D. Pressure

Answer 4

B. Opportunity

See pages 3.740 in the Fraud Examiner’s Manual

In conducting a textual analytics examination, the fraud examiner should create a list of fraud keywords that are likely to suggest suspicious activity. This list will depend on the industry, the suspected fraud schemes or types of fraud risk present, and the data set the fraud examiner has available. In other words, if they are running a search through journal entry details, they will likely search for different fraud keywords than if they were running a search of emails.

The components identified in the Fraud Triangle are helpful when coming up with a fraud keyword list. One of these components is opportunity; consequently, the fraud examiner should consider how someone in the entity might have the opportunity to commit fraud. Examples of keywords that indicate the opportunity to commit fraud include override, write off, recognize revenue, adjust, discount, and reserve/provision.

Question 5

Which of the following is a limitation of Benford’s Law?

A. Benford’s Law applies best to data sets with three-digit numbers.
B. Benford’s Law cannot be applied to data sets with non-natural numbers, such as invoice numbers or inventory prices.
C. Benford’s Law only works on data sets with assigned numbers, such as bank account or telephone numbers.
D. Benford’s Law can only be applied to data sets listed in currency amounts.

Answer 5

B. Benford’s Law cannot be applied to data sets with non-natural numbers, such as invoice numbers or inventory prices.

See pages 3.723 in the Fraud Examiner’s Manual

Benford’s Law distinguishes between natural and non-natural numbers, and it is important to understand the difference between the two types because Benford’s Law cannot be applied to data sets with non-natural numbers. Natural numbers are those numbers that are not ordered in a particular numbering scheme and are not human-generated or generated from a random number system. For example, most vendor invoice totals or listings of payment amounts will be populated by currency values that are natural numbers. Conversely, non-natural numbers (e.g., employee identification numbers and telephone numbers) are designed systematically to convey information that restricts the natural nature of the number. Any number that is arbitrarily determined, such as the price of inventory held for sale, is considered a non-natural number.

Question 6

Which of the following is NOT an example of a data analysis function that can be performed to detect fraud through examination of accounts payable?

A. Audit paid invoices for manual comparison with actual invoices.
B. Identify debits to expense accounts outside of set default accounts.
C. Create vendor detail and summary analysis reports.
D. Sort asset values by asset type or monetary amount.

Answer 6

D. Sort asset values by asset type or monetary amount.

See pages 3.730 in the Fraud Examiner’s Manual

The following are typical examples of data analysis queries that can be performed by data analysis software on accounts payable:

• Audit paid invoices for manual comparison with actual invoices.
• Summarize large invoices by amount, vendor, etc.
• Identify debits to expense accounts outside of set default accounts.
• Reconcile payment registers to disbursements by vendor invoice.
• Verify vendor tax forms (e.g., U.S. Form 1099 or value-added tax [VAT] forms).
• Create vendor detail and summary analysis reports.
• Review recurring monthly expenses and compare to posted/paid invoices.
• Generate a report on specified vouchers for manual audit or investigation.

Question 7

Victoria, a fraud examiner, is concerned that employees are abusing their expense accounts and are spending more than the amount allowed per day for meals. Which of the following is the MOST APPROPRIATE data analysis function for locating meal expenses greater than thirty dollars?

A. Gap testing
B. Duplicate testing
C. Multi-file processing
D. Compliance verification

Answer 7

D. Compliance verification

See pages 3.719 in the Fraud Examiner’s Manual

Compliance verification determines whether company policies are met by employee transactions. If a company limits the amount of its reimbursements, the software can check to see that this limit is being observed. Many times, fraud examiners can find early indications of fraud by testing detail data for values above or below specified amounts. For example, when employees are out of town, do they abide by company policy of not spending more than the amount allowed per day for meals? To start, fraud examiners can look at all expense report data and select those with daily meal expenses exceeding the amount allowed. With the information returned from this simple query, there is a starting point for suspecting fraud.

Question 8

A fraud examiner needs to protect an evidentiary document with a latent fingerprint on it by placing it into a protective container. Which of the following should the fraud examiner include on the container’s label?

A. The date the item was placed in the container
B. The fraud examiner’s initials
C. The location where the document was obtained
D. All of the above

Answer 8

D. All of the above

See pages 3.224-3.225 in the Fraud Examiner’s Manual

Fraud examiners should preserve evidentiary documents that contain latent fingerprints by placing them into labeled protective containers, such as sealable, acid-free paper envelopes. To avoid smudging and contamination of the fingerprints, fraud examiners should wear protective gloves or carefully use tweezers when handling latent fingerprint evidence. Also, fraud examiners should label the item’s container with their initials, the current date, where the document was obtained, and an identifying exhibit number (if any).

Question 9

When collecting physical documents, a fraud examiner should limit their contact with original documents as much as possible to preserve their forensic integrity.

A. True
B. False

Answer 9

A. True

See pages 3.202 in the Fraud Examiner’s Manual

The following general rules are important in the collection of documents:

• Obtain original documents where feasible. Make working copies for review, and keep the originals segregated.
• Do not touch originals any more than necessary, as they could undergo forensic analysis at a later time.
• Maintain a dependable filing system for the documents. This is especially critical when large numbers of documents are obtained. Losing a key document is very problematic and can damage the case. Working copies can be stamped sequentially for easy reference.

Question 10

When seizing a computer for examination, the seizing party should look around the area for passwords because many people leave passwords written down near their computers.

A. True
B. False

Answer 10

A. True

See pages 3.818 in the Fraud Examiner’s Manual

Because many people write down or record their passwords near their computers, fraud examiners should look around for notes that might appear to be passwords. This might aid in discovering passwords needed to access encrypted or password-protected data if the individual who knows the password is uncooperative and will not divulge it. Although there are ways to access encrypted information without an encryption key (e.g., decryption, emergency keys, forcing cooperation), having the passwords for protected files will save time and reduce efforts.

Question 11

Link analysis is particularly useful when investigating which type of fraud scheme?

A. Fictitious vendor
B. Shell company
C. Money laundering
D. All of the above

Answer 11

D. All of the above

See pages 3.743 in the Fraud Examiner’s Manual

Link analysis software is used by fraud examiners to create visual representations (e.g., charts with lines showing connections) of data from multiple data sources to track the movement of money; demonstrate complex networks; and discover communications, patterns, trends, and relationships.

Link analysis is very effective for identifying relationships that are not closely related. For this reason, link analysis is particularly useful when conducting a money laundering investigation, since it can track the placement, layering, and integration of money as it moves around unexpected sources. It could also be used to detect a fictitious vendor (shell company) scheme. For instance, the investigator could map visual connections between a variety of entities that share an address and bank account number to reveal a fictitious vendor created to embezzle funds from a company.

Question 12

Which of the following statements is TRUE regarding data mining?

A. Data mining is an effective way for fraud examiners to develop fraud targets for further investigation
B. Data mining can be used to streamline raw data into understandable patterns
C. Data mining is the science of searching large volumes of data for patterns
D. All of the above

Answer 12

D. All of the above

See pages 3.701, 3.703-3.704 in the Fraud Examiner’s Manual

Data mining is the science of searching large volumes of data for patterns. It combines several different techniques that are essential to detecting fraud, including the streamlining of raw data into understandable patterns. Data mining can also help prevent fraud. Additionally, it is an effective way for fraud examiners to develop fraud targets for further investigation.

Question 13

Which of the following is a data analytics approach involving layered artificial neural networks that are used to identify complex patterns in data sets by accommodating more data and more sophisticated algorithms?

A. Deep learning
B. Unsupervised machine learning
C. Artificial learning
D. Supervised machine learning

Answer 13

A. Deep learning

See pages 3.727-3.728 in the Fraud Examiner’s Manual

Deep learning refers to a subset of artificial intelligence that uses artificial neural networks—systems that simulate the processes and functions of a brain—with many layers to accommodate more data and more sophisticated algorithms to identify complex patterns. Deep learning is capable of learning from unstructured and unlabeled data.

Question 14

Which of the following is an example of a data analysis function that can be performed to detect fraud through an examination of the general ledger?

A. Calculate financial ratios
B. Analyze and confirm specific ledger accounts for legitimate transaction activity
C. Create actual-to-budget comparison reports
D. All of the above

Answer 14

D. All of the above

See pages 3.729 in the Fraud Examiner’s Manual

The following are typical examples of data analysis queries that can be performed by data analysis software on the general ledger:

• Select specific journal entries for analysis.
• Create actual-to-budget comparison reports.
• Analyze and confirm specific ledger accounts for legitimate transaction activity.
• Speed account reconciliation through specialized account queries.
• Calculate financial ratios.
• Calculate percentage comparison ratios between accounts.
• Prepare custom reports, cash flow, profit/loss, and asset and liability total reports.
• Compare summaries by major account in any order (low-high, high-low).
• Create reports in any format by account, division, department, etc.

Question 15

Which of the following is a matter that fraud examiners should consider when engaging in examinations involving computers?

A. Whether law enforcement should be notified
B. Whether an outside digital forensic expert is needed
C. What to look for and where to look for it
D. All of the above

Answer 15

D. All of the above

See pages 3.802, 3.804, 3.808 in the Fraud Examiner’s Manual

Once an organization has received evidence that misconduct involving digital devices has occurred, it should determine the need for law enforcement assistance. If it is determined that the victim organization will make a formal referral to law enforcement or a prosecuting agency, then the organization should notify the authorities before conducting an investigation to determine whether law enforcement personnel should participate in the examination.

When conducting an examination involving computers, fraud examiners should determine whether they need a digital forensic expert. Digital forensic experts are trained professionals who specialize in identifying, recovering, collecting, preserving, processing, and producing digital data for use in investigations and litigation.

To conduct a successful examination, fraud examiners must know what to look for and where to look for it, but this can be difficult because digital data can be stored in large volumes and in numerous locations. For example, the fraud examiner should know where to look for information on any suspect computer systems, information on a suspect’s workstation (including any peripherals or other portable media devices that contain data), information stored on any network from which the suspect’s traffic flows, and information stored in cloud storage services.

Question 16

Cleansing and normalizing data during a data analysis engagement includes reviewing data to ensure that any inconsistencies are fixed, isolated, or eliminated.

A. True
B. False

Answer 16

A. True

See pages 3.708-3.710 in the Fraud Examiner’s Manual

The results of a data analysis test will only be as good as the data used for the analysis. Before running tests on the data, the fraud examiner must make certain the data being analyzed are relevant and reliable for the objective of the engagement.

Depending on how the data were collected and processed, as well as the results of the data verification process, the fraud examiner might need to cleanse and convert the data to a format suitable for analysis before executing any data analysis tests. For example, certain field formats (e.g., date, time, or currency) might need to be modified to make the information consistent and ready for testing. The data must also be normalized so that all data being imported for analysis can be analyzed consistently. Common data fields from multiple systems must be identified, and data must be standardized. In normalizing the data for analysis, table layout, fields/records, data length, data format, and table relationships are all important considerations.

Additionally, the following inconsistencies in the data must be addressed:

• Known errors
• Special/unreadable characters in the data
• Other unusable entries

When possible, such situations should be addressed by fixing, isolating, or eliminating them. Any issues that cannot be cleaned up will require special consideration during the testing and interpretation phase.

Question 17

Hafsa, a fraud examiner, collects a computer hard drive as potential evidence in an investigation. She creates a memorandum to record the chain of custody and documents what item was received, when it was received, and from whom it was received. To meet the minimum standard for a chain of custody memorandum, what else would Hafsa need to include?

A. The name of the judge who signed the seizure order, if applicable
B. An explanation of why the item was collected
C. Where the item is maintained
D. The value of the noncash item received

Answer 17

C. Where the item is maintained

See pages 3.207-3.208 in the Fraud Examiner’s Manual

From the moment evidence is received, its chain of custody must be maintained for it to be accepted by the court. The chain of custody is both a process and a document that memorializes who has had possession of an object and what they have done with it. Essentially, the chain of custody is a recordkeeping procedure similar to physical inventory procedures.

In general, to establish the chain of custody, fraud examiners must make a record of when they, or any other member of the fraud examination team, receive an item and when it leaves their care, custody, or control. This is best handled by creating a memorandum with the custodian of the records when the evidence is received. The memorandum should state:

• What items were received
• When they were received
• From whom they were received
• Where they are maintained

Question 18

Black, a fraud examiner, is conducting textual analytics on emails sent to and from specific employees that her client has identified as fraud suspects. She is using the Fraud Triangle to create a list of fraud keywords to use in her search. Which of the following words found in email text might indicate a fraudster is rationalizing their actions?

A. Write off
B. Override
C. Deserve
D. Quota

Answer 18

C. Deserve

See pages 3.740 in the Fraud Examiner’s Manual

In conducting a textual analytics examination, the fraud examiner should create a list of fraud keywords that are likely to suggest suspicious activity. This list will depend on the industry, the suspected fraud schemes or types of fraud risk present, and the data set the fraud examiner has available. In other words, if they are running a search through journal entry details, they will likely search for different fraud keywords than if they were running a search of emails.

The components identified in the Fraud Triangle are helpful when coming up with a fraud keyword list. One of these components is rationalization; consequently, the fraud examiner should consider how someone in the entity might be able to rationalize committing fraud. Because most fraudsters do not have a criminal background, justifying their actions is a key part of committing fraud. Some keywords that might indicate a fraudster is rationalizing their actions include reasonable, deserve, and temporary.

Other keywords can be used to identify the other components indicated by the Fraud Triangle. For example, write off and override would indicate opportunity to commit fraud, while quota suggests pressure to commit fraud.

Question 19

Which of the following is an example of a data analysis function that can be performed on cash disbursements to help detect fraud?

A. Identify disbursements by department, supervisor approval, or amount limits
B. Verify audit trail for all disbursements by purchase order, vendor, department, etc.
C. Generate summary of vendor cash activity for further analysis
D. All of the above

Answer 19

D. All of the above

See pages 3.730 in the Fraud Examiner’s Manual

The following are examples of data analysis queries that can be performed by data analysis software on cash disbursements to help detect fraud:

• Summarize cash disbursements by account, bank, department, vendor, etc.
• Verify audit trail for all disbursements by purchase order, vendor, department, etc.
• Generate summary of vendor cash activity for analysis.
• Identify disbursements by department, supervisor approval, or amount limits.

Question 20

Tangible evidence is more volatile than digital evidence because tangible information is subject to claims of spoliation whereas digital evidence is not.

A. True
B. False

Answer 20

B. False

See pages 3.805-3.806 in the Fraud Examiner’s Manual

Digital evidence is more volatile than tangible evidence because digital data can be altered or destroyed more easily than tangible information. Additionally, both digital and tangible evidence are subject to claims of spoliation (the act of intentionally or negligently destroying documents relevant to litigation). If proven, such claims could lead to monetary fines and sanctions, adverse inference jury instruction sanctions, or dismissal of claims or defenses.

Question 21

Which of the following data analysis functions can be used to determine the relationship between two variables in raw data?

A. Correlation analysis
B. Duplicate testing
C. Gap testing
D. Benford’s Law analysis

Answer 21

A. Correlation analysis

See pages 3.717 in the Fraud Examiner’s Manual

By using the correlation analysis function, fraud examiners can determine the relationships among different variables in the raw data. Fraud examiners can learn a lot about data files by learning the relationship between two variables. For example, one should expect a strong correlation between the following independent and dependent variables because a direct relationship exists between the two variables. Hotel costs should increase as the number of days traveled increases. Gallons of paint used should increase as the number of houses painted increases.

Question 22

A statement collected by a fraud examiner during an interview would be considered an example of which of the following types of evidence?

A. Digital evidence
B. Testimonial evidence
C. Inconclusive evidence
D. Documentary evidence

Answer 22

B. Testimonial evidence

See pages 3.201 in the Fraud Examiner’s Manual

Testimonial evidence involves statements made by witnesses, neutral third parties, and suspects during interviews and/or when testifying at trial.

Question 23

Which of the following is TRUE concerning the volatility of digital evidence?

A. The failure to preserve the integrity of digital evidence could result in evidence being deemed inadmissible in a legal proceeding
B. Once the integrity of digital evidence has been violated through alteration or destruction, it usually cannot be restored
C. Digital evidence is more volatile than tangible evidence because data can be altered or destroyed more easily than tangible information
D. All of the above

Answer 23

D. All of the above

See pages 3.805-3.806 in the Fraud Examiner’s Manual

Digital evidence is more volatile than tangible evidence because digital data can be altered or destroyed more easily than tangible information. Because digital evidence can be easily altered or destroyed, the integrity of digital evidence must be preserved. Data that have been altered or destroyed are considered violations of data integrity. What is more, the alteration or destruction of digital evidence is typically irreversible; therefore, once the integrity of digital evidence has been violated, it usually cannot be restored.

Additionally, the failure to preserve the integrity of digital evidence could result in evidence being deemed inadmissible in a legal proceeding, or even if admitted, it might not be given much weight because evidence of questionable authenticity does not provide reliable proof.

Question 24

A fraud examiner is planning a data analysis engagement. Which of the following should the fraud examiner understand prior to determining which tests to run on the data?

A. Areas of data at risk for being overlooked
B. The structure of the data
C. What data are available for analysis
D. All of the above

Answer 24

D. All of the above

See pages 3.705-3.706 in the Fraud Examiner’s Manual

Although the purpose of data analysis involves running targeted tests on data to identify anomalies, the ability of such tests to help detect fraud depends greatly on what the fraud examiner does before and after performing the data analysis techniques. Without sufficient time and attention devoted to planning, the fraud examiner risks analyzing the data inefficiently, lacking focus or direction for the engagement, encountering avoidable technical difficulties, and possibly overlooking key areas for exploration.

As a first step in the planning process—before determining which tests to run—the fraud examiner must know what data are available to be analyzed and how those data are structured. Understanding the structure of the existing data will not only help ensure that the fraud examiner builds workable tests to be run on the data but might also help identify additional areas for exploration that might otherwise have been overlooked.

Question 25

During which phase of the data analysis process does the fraud examiner identify, obtain, and verify the relevant or requested data?

A. The testing and interpretation phase
B. The planning phase
C. The preparation phase
D. The post-analysis phase

Answer 25

C. The preparation phase

See pages 3.708-3.710 in the Fraud Examiner’s Manual

The second phase of the data analysis process is the preparation phase. The results of a data analysis test will only be as good as the data used for the analysis. Before running tests on the data, the fraud examiner must make certain the data being analyzed are relevant and reliable for the objective of the engagement. During the preparation phase of the data analysis process, the fraud examiner must complete several important steps, including:

• Identifying the relevant data
• Obtaining the requested data
• Verifying the data
• Cleansing and normalizing the data

Question 26

The information in a computer system’s event logs can yield valuable evidence because such logs record events and transactions that have occurred on the computer.

A. True
B. False

Answer 26

A. True

See pages 3.810 in the Fraud Examiner’s Manual

Every operating system generates event logs, which are files that record events or transactions on a computer. In fact, a log entry is created for each event or transaction that takes place on any computer, and consequently, there are numerous types of event logs. Some common types of logs include system logs, application logs, and security logs. System logs record events executed on an operating system, including miscellaneous events and those generated during system start-up, such as hardware and controller failures. Common types of system events include starting up and shutting down, configuration updates, and system crashes. Application logs record the events regarding access to application data. Such events would include data files being opened or closed; specific actions such as reading, editing, deleting, or printing of application files; or the modification of records in an application file. Security logs track security-related events like log-on and log-off times and changes to access rights.

Question 27

Robotic process automation (RPA) is a data analytics approach that uses historical data, analyses, statistics, and machine learning components to build a mathematical model that depicts important trends and creates a quantitative projection or prediction about future events or outcomes.

A. True
B. False

Answer 27

B. False

See pages 3.728 in the Fraud Examiner’s Manual

Predictive analytics uses historical data, analyses, statistics, and machine learning components to build a mathematical model that depicts important trends. This model is then used to process current data to create a quantitative projection or prediction about future events or outcomes.

Robotic process automation (RPA) is a technology that allows for the configuration of a program that imitates and integrates the actions of a human to execute certain business processes. RPA is useful for organizations that wish to increase efficiency and automate repetitive manual tasks. One of the benefits that RPA provides in fighting fraud is the lessening of human interaction in day-to-day tasks. When employees are responsible for inputting data into systems, there is an opportunity for them to manipulate the data for personal gain. By fully automating certain tasks, employees are turned into reviewers rather than inputters. Also, by limiting human interaction, RPA mitigates the risk caused by human error.

Question 28

In which of the following situations would a fraud examiner MOST LIKELY need to obtain a court order to access a suspect’s financial records?

A. A fraud examiner would likely need to obtain a court order if the suspect provides both oral and written consent.
B. A fraud examiner would likely need to obtain a court order if the suspect only provides written consent.
C. A fraud examiner would likely need to obtain a court order any time that records are requested from a financial institution.
D. A fraud examiner would likely need to obtain a court order if the suspect refuses to provide consent.

Answer 28

D. A fraud examiner would likely need to obtain a court order if the suspect refuses to provide consent.

See pages 3.202-3.203 in the Fraud Examiner’s Manual

Documentary evidence can be obtained in several ways. The preferred method is to obtain evidence by consent if both parties agree. In some cases, consent can be oral, but when information is obtained from possible adverse witnesses or the target of the examination, it is recommended that the consent be in writing.

Certain types of records can be obtained by consent only if the subject of the records consents in writing. Accessing a subject’s bank records from financial institutions, for instance, generally requires written consent. If no consent is given and evidence is held by other parties or in uncontrolled locations, specific legal action might be required. Most often, the legal process used takes the form of a subpoena or other court order to produce the documents and records (including electronic records). Other forms of court orders can be used to obtain witness evidence and statements.

Question 29

Understanding the data, determining whether predication exists, and building a profile of potential frauds are all steps of which phase of the data analysis process?

A. The post-analysis phase
B. The testing and interpretation phase
C. The preparation phase
D. The planning phase

Answer 29

D. The planning phase

See pages 3.705-3.706 in the Fraud Examiner’s Manual

As with most tasks, proper planning is essential in a data analysis engagement. Without sufficient time and attention devoted to planning, the fraud examiner risks analyzing the data inefficiently, lacking focus or direction for the engagement, encountering avoidable technical difficulties, and possibly overlooking key areas for exploration.

The first phase of the data analysis process is the planning phase. This phase consists of several important steps, including:

• Understanding the data
• Defining examination objectives
• Building a profile of potential frauds
• Determining whether predication exists

Question 30

Jones, a Certified Fraud Examiner (CFE) and director of security for ABC Inc., obtained several boxes of documents while conducting a fraud examination. While inventorying the boxes and marking the evidence, Jones discovers a stock certificate he feels will be damaged if he marks it with his initials and the date. To maintain the proper chain of custody, Jones should:

A. Mark the document regardless of the potential for damage.
B. Copy the document, and initial and date the copy.
C. Photograph and store the document.
D. Place the document in a marked envelope.

Answer 30

D. Place the document in a marked envelope.

See pages 3.207 in the Fraud Examiner’s Manual

To preserve the chain of custody, all evidence received should be marked so that it can later be identified. The most common way to mark the evidence is with the date and initials of the person obtaining the documents. If it is not practical to mark the document, or if marking it would damage the document, then it should be placed in an acid-free envelope that has been marked and sealed. To avoid creating indentations on the original document, do not write on the envelope after the document has been placed inside of it.

Question 31

During the analysis phase in digital forensic investigations, the fraud examiner’s primary concern is to protect the collected information from seizure.

A. True
B. False

Answer 31

B. False

See pages 3.829 in the Fraud Examiner’s Manual

The primary concern when analyzing digital evidence is to always maintain the integrity of the data. Fraud examiners must be especially careful with computer equipment because a careless fraud examiner might inadvertently alter important evidence. Therefore, it is helpful to develop procedures to prevent the opposing party from raising allegations that the methodology used to collect or analyze data was improper and could have damaged or altered the evidence.

Question 32

Christie is undertaking a data analysis engagement to identify potential fraud at XYZ Corporation. Which of the following lists the MOST APPROPRIATE order in which she should conduct the steps involved in the data analysis process?

I. Cleanse and normalize the data.
II. Build a profile of potential frauds.
III. Analyze the data.
IV. Obtain the data.
V. Monitor the data.

A. II, IV, I, III, V
B. IV, I, III, V, II
C. II, IV, III, I, V
D. IV, II, I, V, III

Answer 32

A. II, IV, I, III, V

See pages 3.705-3.706 in the Fraud Examiner’s Manual

To ensure the most accurate and meaningful results, a formal data analysis process should be applied that begins several steps before the tests are run and concludes with active and ongoing review of the data. While the specific process will vary based on the realities and needs of the organization, the following approach contains steps that should be considered and implemented, to the appropriate extent, in each data analysis engagement:

1. Planning phase

• Understand the data.
• Define examination objectives.
• Build a profile of potential frauds.
• Determine whether predication exists.

2. Preparation phase

• Identify the relevant data.
• Obtain the data.
• Verify the data.
• Cleanse and normalize the data.

3. Testing and interpretation phase

• Analyze the data.

4. Post-analysis phase

• Respond to the analysis findings.
• Monitor the data.

Question 33

Black, a Certified Fraud Examiner (CFE), has obtained an oral confession from Green, a fraud suspect. Black wants to examine Green’s bank accounts. Which of the following would be the LEAST EFFECTIVE way to obtain permission to examine Green’s bank records?

A. Obtain a court order.
B. Obtain Green’s oral consent.
C. Obtain a subpoena.
D. Obtain Green’s written consent.

Answer 33

B. Obtain Green’s oral consent.

See pages 3.202-3.203 in the Fraud Examiner’s Manual

Documentary evidence can be obtained in several ways. The preferred method is to obtain evidence by consent if both parties agree. In some cases, consent can be oral, but when information is obtained from possible adverse witnesses or the target of the examination, it is recommended that the consent be in writing.

Certain types of records can be obtained by consent only if the subject of the records consents in writing. Accessing a subject’s bank records from financial institutions, for instance, generally requires written consent. If no consent is given and evidence is held by other parties or in uncontrolled locations, specific legal action might be required. Most often, the legal process used takes the form of a subpoena or other court order to produce the documents and records (including electronic records). Other forms of court orders can be used to obtain witness evidence and statements.

Question 34

Which of the following is an example of a data analysis function that can be performed to help detect fraud through examination of payroll accounts?

A. Check proper supervisory authorization on payroll disbursements.
B. Generate depreciation to asset cost reports.
C. Compare customer credit limits and current or past balances.
D. Compare approved vendors to the cash disbursement payee list.

Answer 34

A. Check proper supervisory authorization on payroll disbursements.

See pages 3.730-3.731 in the Fraud Examiner’s Manual

The following are examples of data analysis queries that can be performed by data analysis software on payroll accounts to help detect fraud:

• Summarize payroll activity by specific criteria for review.
• Identify changes to payroll or employee files.
• Compare time card and payroll rates for possible discrepancies.
• Identify paychecks with amounts over a certain limit.
• Check proper supervisory authorization on payroll disbursements.

Question 35

Generally, the rules of admissibility for digital evidence are stricter than such rules for tangible evidence.

A. True
B. False

Answer 35

B. False

See pages 3.807 in the Fraud Examiner’s Manual

Although digital evidence is different from—and more volatile than—tangible evidence, the rules regarding the admissibility of digital evidence in court are no different from the rules regarding the admissibility of any other type of evidence.

Question 36

________ is a data analysis software function that allows users to relate several files by defining relationships in collected data without using the Join command.

A. Correlation analysis
B. Multi-file processing
C. Record selection
D. Verifying multiples of a number

Answer 36

B. Multi-file processing

See pages 3.717 in the Fraud Examiner’s Manual

Multi-file processing allows the user to relate several files by defining relationships between multiple files without using the Join command. A common data relationship would be to relate an outstanding invoice master file to an accounts receivable file based on the customer number. The relationship can be further extended to include an invoice detail file based on invoice number. This relationship will allow the user to see which customers have outstanding invoices sorted by date.

Question 37

If you are seizing a computer for forensic analysis, it is generally unnecessary to seize copiers connected to it.

A. True
B. False

Answer 37

B. False

See pages 3.812 in the Fraud Examiner’s Manual

Copiers, scanners, and other multifunction devices—machines that provide printing, copying, scanning, and faxing functionalities in one device—have internal hard drives that might contain information relevant to a fraud examination. Many modern copiers have a hard drive that stores images of documents the machines have copied, scanned, or emailed. Some copiers store user access records and a history of copies made. And, as with most file systems, it might be possible to retrieve information from a copier’s hard drive that has been deleted. Therefore, when seizing a computer for forensic analysis, it is generally necessary to seize any copiers connected to it.

Question 38

___________ can BEST be described as a data analytics approach involving a learning algorithm that identifies similarities, patterns, or anomalies within a data set without the involvement of a human.

A. Link analysis
B. Predictive analytics
C. Supervised machine learning
D. Unsupervised machine learning

Answer 38

D. Unsupervised machine learning

See pages 3.727-3.728, 3.743 in the Fraud Examiner’s Manual

Machine learning, which is a subset of artificial intelligence, is a learning algorithm that enables programs to identify patterns and outliers in large data sets. With supervised machine learning, humans identify patterns for the programs to look for in data sets, and the programs identify any data that fit the patterns. Depending on the program or system, it might provide automatic responses to instances of identified patterns or prompt humans to review any identified data.

Unsupervised machine learning involves a program identifying similarities, patterns, or anomalies within a data set without the involvement of a human. The program will not determine what the similarity, pattern, or anomaly means, just that it exists. Unsupervised machine learning programs are most useful in identifying patterns in large data sets that can then be turned into rules for supervised machine learning programs.

Predictive analytics uses historical data, analyses, statistics, and machine learning components to build a mathematical model that depicts important trends. This model is then used to process current data to create a quantitative projection or prediction about future events or outcomes.

Link analysis is a type of software used by fraud examiners to create visual representations (e.g., charts with lines showing connections) of data from multiple data sources to track the movement of money; demonstrate complex networks; and discover communications, patterns, trends, and relationships.

Question 39

Which of the following is a data analysis tool that is effective in demonstrating complex networks and identifying relationships that are not closely related?

A. Link analysis
B. Tree maps
C. Geospatial analysis
D. Word maps

Answer 39

A. Link analysis

See pages 3.743 in the Fraud Examiner’s Manual

Link analysis software is used by fraud examiners to create visual representations (e.g., charts with lines showing connections) of data from multiple data sources to track the movement of money; demonstrate complex networks; and discover communications, patterns, trends, and relationships.

Link analysis is very effective for identifying relationships that are not closely related. For this reason, link analysis is particularly useful when conducting a money laundering investigation, since it can track the placement, layering, and integration of money as it moves around unexpected sources. It could also be used to detect a fictitious vendor (shell company) scheme. For instance, the investigator could map visual connections between a variety of entities that share an address and bank account number to reveal a fictitious vendor created to embezzle funds from a company.

Question 40

When seizing a computer that is running, a fraud examiner should generally NOT search the computer for evidence because doing so might damage and taint relevant evidence.

A. True
B. False

Answer 40

A. True

See pages 3.817, 3.819 in the Fraud Examiner’s Manual

When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence. But in some situations, it might be appropriate to perform live evidence collection, or live acquisition (i.e., collect evidence from a suspect system while the system is open and running via its normal interface). Generally, live evidence collection is only appropriate when a formally trained digital forensic examiner is seizing the system and the evidence that they need to collect exists only in the form of volatile data.

Question 41

Which of the following data analysis functions is MOST USEFUL in testing for hidden journal entries?

A. Gap testing
B. Aging analysis
C. Duplicate testing
D. Statistical sampling

Answer 41

A. Gap testing

See pages 3.720 in the Fraud Examiner’s Manual

Gap testing is used to identify missing items in a sequence or series, such as missing invoice numbers. It can also be used to find sequences where none are expected to exist (e.g., employee government identification numbers). In reviewing journal entries, gaps might signal possible hidden entries.

Question 42

During the analysis phase in digital forensic investigations, it is BEST to use just one forensic tool for identifying, extracting, and collecting digital evidence.

A. True
B. False

Answer 42

B. False

See pages 3.829 in the Fraud Examiner’s Manual

The analysis phase involves the use of specialized software designed to give the fraud examiner the means to identify, extract, collect, examine, and store digital artifacts that will be used as evidence in the investigation.

There are numerous analytical review products that can assist in analyzing volumes of data for relevant evidence, but generally, these products employ various ways to search and analyze data for relevant materials. Unfortunately, due to the vast array of digital devices available, there is no single perfect tool or platform. No single analytical review tool can recover everything; each tool has its own strengths and weaknesses. Therefore, it is best to use a combination of the various tools during the analysis phase, allowing for the identification and recovery of more information.

Question 43

Internet browsers create _____________, which store information about websites that a user has visited and images previously viewed online.

A. System logs
B. Operating system files
C. Temporary files
D. Event logs

Answer 43

C. Temporary files

See pages 3.811 in the Fraud Examiner’s Manual

Internet browsers create temporary files that store information about websites that a user has visited. These files can show websites that were recently visited and usually include time and date information relevant to the visit; they can also show images previously viewed online. This information allows the fraud examiner to recover websites and images previously viewed by the system’s users.

Question 44

Link analysis software creates visual representations of data from multiple data sources and can be used to track the movement of money over time.

A. True
B. False

Answer 44

A. True

See pages 3.743 in the Fraud Examiner’s Manual

Link analysis software is used by fraud examiners to create visual representations (e.g., charts with lines showing connections) of data from multiple data sources to track the movement of money; demonstrate complex networks; and discover communications, patterns, trends, and relationships.

Link analysis is very effective for identifying relationships that are not closely related. For this reason, link analysis is particularly useful when conducting a money laundering investigation, since it can track the placement, layering, and integration of money as it moves around unexpected sources. It could also be used to detect a fictitious vendor (shell company) scheme. For instance, the investigator could map visual connections between a variety of entities that share an address and bank account number to reveal a fictitious vendor created to embezzle funds from a company.

Question 45

Encryption refers to procedures used to convert information using an algorithm (called a cipher) that makes the information unreadable.

A. True
B. False

Answer 45

A. True

See pages 3.809 in the Fraud Examiner’s Manual

Encryption refers to procedures used to convert information using an algorithm (called a cipher) into a coded format that makes the information unreadable.

Question 46

Which of the following steps takes place during the preparation phase of a data analysis engagement?

A. Defining examination objectives
B. Determining whether predication exists
C. Building a profile of potential frauds
D. Cleansing and normalizing the data

Answer 46

D. Cleansing and normalizing the data

See pages 3.705-3.706, 3.708 in the Fraud Examiner’s Manual

Defining the examination objectives, determining whether predication exists, and building a profile of potential frauds are all steps of the planning phase of the data analysis process, which is the first phase that should be undertaken. The second phase of the data analysis process is the preparation phase. The results of a data analysis test will only be as good as the data used for the analysis. Before running tests on the data, the fraud examiner must make certain the data being analyzed are relevant and reliable for the objective of the engagement. During the preparation phase of the data analysis process, the fraud examiner must complete several important steps, including:

• Identifying the relevant data
• Obtaining the requested data
• Verifying the data
• Cleansing and normalizing the data

Question 47

Which of the following methods can be used to obtain documentary evidence?

A. Oral consent
B. Court order
C. Written consent
D. All of the above

Answer 47

D. All of the above

See pages 3.202-3.203 in the Fraud Examiner’s Manual

Documentary evidence can be obtained in several ways. The preferred method is to obtain evidence by consent if both parties agree. In some cases, consent can be oral, but when information is obtained from possible adverse witnesses or the target of the examination, it is recommended that the consent be in writing.

Certain types of records can be obtained by consent only if the subject of the records consents in writing. Accessing a subject’s bank records from financial institutions, for instance, generally requires written consent. If no consent is given and evidence is held by other parties or in uncontrolled locations, specific legal action might be required. Most often, the legal process used takes the form of a subpoena or other court order to produce the documents and records (including electronic records). Other forms of court orders can be used to obtain witness evidence and statements.

Question 48

A fraud examiner is conducting textual analytics on journal entry data and runs a keyword search using the terms deadline, quota, and trouble. With which component of the Fraud Triangle are these fraud keywords typically associated?

A. Rationalization
B. Pressure
C. Capability
D. Opportunity

Answer 48

B. Pressure

See pages 3.740 in the Fraud Examiner’s Manual

In conducting a textual analytics examination, the fraud examiner should create a list of fraud keywords that are likely to suggest suspicious activity. This list will depend on the industry, the suspected fraud schemes or types of fraud risk present, and the data set the fraud examiner has available. In other words, if they are running a search through journal entry details, they will likely search for different fraud keywords than if they were running a search of emails.

The components identified in the Fraud Triangle are helpful when coming up with a fraud keyword list. One of these components is pressure; consequently, the fraud examiner should consider how someone in the entity might be under pressure to commit fraud. For example, many people commit fraud because of something that has happened in their life that motivates them to steal. Maybe they find themselves in debt, or perhaps they must meet a certain goal to qualify for a performance-based bonus. Keywords that might indicate pressure include deadline, quota, trouble, short, problem, and concern.

Question 49

In data analysis, date fields are generally NOT a problem when importing and exporting data because standard formats are always used.

A. True
B. False

Answer 49

B. False

See pages 3.731 in the Fraud Examiner’s Manual

When conducting data analysis, the fraud examiner must consider the data format and structure. This consideration is important when the fraud examiner wishes to import or export data with their computer. A date can be formatted into different styles, such as mm/dd/yyyy. The structure of the data will also be important, along with the extension. A text file will have a .txt extension associated with it. In what format are the current data? What format will the computer require? How does the fraud examiner get the data from here to there if the data formats and structures are different?

Question 50

Which of the following is a unique challenge of cloud forensics that is not encountered in traditional forensic investigations?

A. A lack of data control
B. Jurisdiction of storage
C. A lack of frameworks and specialist tools
D. All of the above

Answer 50

D. All of the above

See pages 3.830 in the Fraud Examiner’s Manual

Conducting digital forensic investigations in the cloud environment (i.e., cloud forensics) presents challenges not encountered in traditional forensic investigations. Some of the important challenges of acquiring evidence from the cloud are:

• A lack of frameworks and specialist tools
• A lack of information accessibility
• A lack of data control
• A lack of knowledge
• Jurisdiction of storage
• Electronic discovery
• Preserving chain of custody
• Resource sharing

Question 51

Which of the following is a factor that might affect whether a fraud examiner should dispose of evidence following the conclusion of a fraud examination?

A. The requirements in an organization’s document retention policy
B. The personal information about suspects or witnesses documented in the evidence
C. The likelihood of further litigation related to the engagement
D. All of the above

Answer 51

D. All of the above

See pages 3.226 in the Fraud Examiner’s Manual

Once an investigation or examination has concluded, fraud examiners might need to direct or participate in the disposal of evidence that was collected during an engagement. Organizational policies specifying procedures for proper disposal of evidence can provide guidance, but organizations might not have such policies in place. Additionally, circumstances related to an engagement might need to be considered, even if a policy on evidence disposal exists. Factors that could potentially affect evidence disposal following the conclusion of a fraud investigation or examination are:

• The personal information about suspects or witnesses that is documented in the evidence
• Jurisdictional regulations
• The likelihood of further litigation related to the engagement
• Organizational policies related to the disposal of sensitive information
• General document retention policies implemented by the organization
• Litigation holds related to the engagement

Any of these factors could require the evidence to be retained, disposed of, or returned to its owner in a specific manner. Before disposing of any evidence acquired during an investigation or other engagement, fraud examiners should ensure that they comply with any applicable requirements.

Question 52

Before removing a computer system from a scene for further analysis, it is important to document the system’s setup with photographs or diagrams.

A. True
B. False

Answer 52

A. True

See pages 3.817 in the Fraud Examiner’s Manual

The first step in the evidence collection process is to examine and document the machine’s surroundings. The party seizing the computer should collect all printouts, disks, notes, and other physical evidence for further analysis and document the scene with photographs or a diagram, depending on the complexity of the setup. Documenting the machine’s surroundings is important because the party seizing the computer might have to testify about what the area looked like on the day of the seizure, and it might be a year or longer before such testimony occurs.

Question 53

When seizing a running computer for forensic examination, the seizing party should perform a graceful shutdown by turning off the computer using the normal shutdown process.

A. True
B. False

Answer 53

B. False

See pages 3.823 in the Fraud Examiner’s Manual

When seizing a computer that is running, the seizing party should not perform a graceful shutdown by turning it off using the normal shutdown process. If a system is turned off using normal shutdown routines, then numerous temporary files will be deleted and possibly overwritten during the shutdown process, and such files might be important to the investigation.

Question 54

Which of the following functions does a Benford’s Law analysis help to achieve?

A. Extracting usable information from unstructured text data
B. Measuring the relationship between items on financial statements by expressing accounts as percentages
C. Identifying fictitious numbers
D. Identifying duplicate payments

Answer 54

C. Identifying fictitious numbers

See pages 3.724 in the Fraud Examiner’s Manual

The goal of a Benford’s Law analysis is to identify fictitious numbers. Benford’s Law provides that the distribution of the digits in multi-digit natural numbers is not random; instead, it follows a predictable pattern. When natural numbers are present, Benford’s Law maintains that certain digits show up more than others do. A 1 appears as the first non-zero digit roughly 30% of the time; 2 is the leading digit almost 18% of the time; and 9 leads only 4.6% of the time. Moreover, 0 is most likely to be the second digit, appearing 12% of the time.

Many fraudsters are unaware of or fail to consider the Benford’s Law pattern when creating false documentation or transactions to cover their tracks. Consequently, testing data sets for the occurrence or nonoccurrence of the predictable digit distribution can help identify included numbers that are not legitimate.

Question 55

Which of the following is generally NOT a recommended practice when organizing physical evidence?

A. Segregating original documents from working copies
B. Establishing a database early in the investigation
C. Filing all documents in chronological order
D. Making a key document file with the most relevant documents

Answer 55

C. Filing all documents in chronological order

See pages 3.202-3.204 in the Fraud Examiner’s Manual

Keeping track of the amount of paper generated is one of the biggest problems in fraud examinations. Effective organization in complex examinations includes the following:

• Segregating documents by either witness or transaction
• Making a key document file for easy access to the most relevant documents
• Establishing a database early in the investigation

The following general rules are important in the collection of documents:

• Obtain original documents where feasible. Make working copies for review, and keep the originals segregated.
• Do not touch originals any more than necessary, as they could undergo forensic analysis at a later time.
• Maintain a dependable filing system for the documents. This is especially critical when large numbers of documents are obtained. Losing a key document is very problematic and can damage the case. Working copies can be stamped sequentially for easy reference.

During the evidence-gathering stage of an investigation, organizing the documents chronologically is not recommended because it makes searching for relevant information more difficult. It is generally better to organize the documents by transaction or by party. The fraud examination report often follows a chronological timeline to give a narrative of a fraud scheme, in which case displaying key documents chronologically is often best. But in the organization phase, there is usually too much clutter for chronological organization to be effective.

Question 56

Which of the following is the MOST ACCURATE statement about the types of information that digital forensic experts can typically recover from computer systems?

A. Hidden files can never be recovered.
B. Communications sent via instant message or email cannot be recovered.
C. Deleted files that have been overwritten generally cannot be recovered.
D. Data that are corrupted cannot be uncorrupted.

Answer 56

C. Deleted files that have been overwritten generally cannot be recovered.

See pages 3.801-3.803 in the Fraud Examiner’s Manual

Digital forensics encompasses the recovery and investigation of data found in digital devices, and digital forensic experts are trained professionals who specialize in identifying, recovering, collecting, preserving, processing, and producing digital data for use in investigations and litigation.

Digital forensic experts are often able to recover evidence that a nonexpert cannot. For example, if the target of an investigation tried to delete electronic evidence, then an expert might be able to recover it. There are a variety of ways to recover deleted or hidden data from a target computer, and digital forensic experts are specially trained for such tasks. Deleted files, both those that have been purposely deleted and those that were accidentally deleted, are sometimes recoverable because data are not erased from a computer’s hard drive until the operating system overwrites all or some of the files. Digital forensic experts usually cannot recover deleted files that have been overwritten.

Digital forensic experts can recover, among other things, the following types of information from computers:

• Deleted files and other data that have not been overwritten (e.g., deleted documents, images, link or shortcut files, and email messages)
• Files deleted through computer-automated processes
• Temporary auto-save files
• Print-spool files
• Websites visited, even where the browser history and cache have been deleted
• Communications sent via email, chat, or instant message (IM)
• Financial-based internet transactions
• Documents, letters, and images created, modified, or accessed, even if the data were not saved on the computer
• Data that have been copied, corrupted, or moved
• Time and date information about files (e.g., when files were created, accessed, modified, installed, deleted, or downloaded)
• Data from a drive that has been defragmented or reformatted
• Hidden files

Question 57

When a digital forensic examiner is seizing a running computer for examination, they can retrieve data from the computer while the system is open and operating like normal if the evidence needed exists only in the form of volatile data.

A. True
B. False

Answer 57

A. True

See pages 3.817, 3.819 in the Fraud Examiner’s Manual

When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence. But in some situations, it might be appropriate to perform live evidence collection, or live acquisition (i.e., collect evidence from a suspect system while the system is open and running via its normal interface). Generally, live evidence collection is only appropriate when a formally trained digital forensic examiner is seizing the system and the evidence that they need to collect exists only in the form of volatile data.

Question 58

Which of the following steps is included in the planning phase of the data analysis process?

A. Defining examination objectives
B. Determining whether predication exists
C. Building a profile of potential frauds
D. All of the above

Answer 58

D. All of the above

See pages 3.705-3.706 in the Fraud Examiner’s Manual

As with most tasks, proper planning is essential in a data analysis engagement. Without sufficient time and attention devoted to planning, the fraud examiner risks analyzing the data inefficiently, lacking focus or direction for the engagement, encountering avoidable technical difficulties, and possibly overlooking key areas for exploration.

The first phase of the data analysis process is the planning phase. This phase consists of several important steps, including:

• Understanding the data
• Defining examination objectives
• Building a profile of potential frauds
• Determining whether predication exists

Question 59

Machine learning programs are ONLY capable of identifying patterns that have been identified by humans.

A. True
B. False

Answer 59

B. False

See pages 3.727 in the Fraud Examiner’s Manual

Machine learning, which is a subset of artificial intelligence, is a learning algorithm that enables programs to identify patterns and outliers in large data sets. With supervised machine learning, humans identify patterns for the programs to look for in data sets, and the programs identify any data that fit the patterns. Depending on the program or system, it might provide automatic responses to instances of identified patterns or prompt humans to review any identified data.

Unsupervised machine learning involves a program identifying similarities, patterns, or anomalies within a data set without the involvement of a human. The program will not determine what the similarity, pattern, or anomaly means, just that it exists. Unsupervised machine learning programs are most useful in identifying patterns in large data sets that can then be turned into rules for supervised machine learning programs.

Question 60

Clarissa suspects that there is a ghost employee scheme taking place at her organization. She wants to compare the payroll records to the employee master file. Which data analysis technique should Clarissa use to match these two data records?

A. Gap testing
B. Correlation analysis
C. The Join function
D. Compliance verification

Answer 60

C. The Join function

See pages 3.716 in the Fraud Examiner’s Manual

The Join function gathers the specified parts of different data files. Joining files combines fields from two sorted input files into a third file. Join is used to match data in a transaction file to records in a master file, such as matching invoice data in an accounts receivable file to a master list of approved vendors. For example, a fraud examiner might need to compare two different files to find differing records between them.

Question 61

Which of the following is NOT one of the primary types of evidence that fraud examiners must consider or gather when conducting investigations?

A. Documentary evidence
B. Testimonial evidence
C. Digital evidence
D. Incriminating evidence

Answer 61

D. Incriminating evidence

See pages 3.201 in the Fraud Examiner’s Manual

Most fraud examinations involve the collection of three main types of evidence. The three primary types of evidence that fraud examiners must consider and gather when conducting their investigations are:

• Testimonial evidence
• Digital evidence
• Documentary evidence

Question 62

Because digital evidence is different from tangible evidence, the rules regarding its admissibility in court are very different from the rules governing the admissibility of tangible evidence.

A. True
B. False

Answer 62

B. False

See pages 3.807-3.808 in the Fraud Examiner’s Manual

Although digital evidence is different from tangible evidence, the rules regarding the admissibility of digital evidence in court are no different from the rules regarding the admissibility of any other type of evidence.

If fraud examiners collect digital evidence, they should be able to state unequivocally that the evidence was not changed in any way by their actions. This requires that strict forensic methodologies be followed to satisfy the stringent evidentiary standards necessary to ensure the integrity of the evidence beyond a reasonable doubt for presentation in court. That is, digital evidence must be properly preserved in a forensically sound manner so that it will be admissible.

Question 63

Which of the following is a core data analysis function that can be performed with most data analysis software applications?

A. Duplicate testing
B. Joining files
C. Sorting
D. All of the above

Answer 63

D. All of the above

See pages 3.714-3.715 in the Fraud Examiner’s Manual

Computers can scan database information for several specific types of information, creating a red flag system. To perform this, most software packages use a combination of different functions. These functions are:

• Sorting
• Record selection
• Joining files
• Multi-file processing
• Correlation analysis
• Verifying multiples of a number
• Compliance verification
• Duplicate testing
• Expressions and equations
• Filter and display criteria
• Fuzzy logic matching
• Gap tests
• Pivot tables
• Regression analysis
• Sort and index
• Statistical analysis
• Stratification
• Date functions
• Benford’s Law analysis
• Graphing

Question 64

During the analysis phase in digital forensic investigations, the fraud examiner should look for exculpatory evidence but not inculpatory evidence.

A. True
B. False

Answer 64

B. False

See pages 3.829 in the Fraud Examiner’s Manual

When analyzing data for evidence, the fraud examiner should look for inculpatory evidence (i.e., evidence that serves to incriminate the subject of the investigation) and exculpatory evidence (i.e., evidence that serves to disprove the subject’s involvement in the misconduct).

Question 65

Forensic analysis should NOT be performed directly on suspect devices because doing so can alter or damage digital evidence.

A. True
B. False

Answer 65

A. True

See pages 3.826 in the Fraud Examiner’s Manual

Once a computer system is seized and before any analysis occurs, it should be imaged for analysis. Forensic analysis should not be performed directly on suspect devices because doing so can alter or damage digital evidence. Imaging the data from suspect devices allows a fraud examiner to view and analyze a computer’s contents without altering the original data in any way.

Imaging refers to the process whereby a forensic image of a hard drive or other digital media is made and imaged to another hard disk drive or other media for forensic analysis. A forensic image (also called a forensic copy, mirror image, or ghost image) is a duplicate or exact copy of a hard drive or other digital media.

Question 66

For a Benford’s Law analysis, an employee identification number would be considered a natural number.

A. True
B. False

Answer 66

B. False

See pages 3.723 in the Fraud Examiner’s Manual

Benford’s Law distinguishes between natural and non-natural numbers, and it is important to understand the difference between the two types because Benford’s Law cannot be applied to data sets with non-natural numbers. Natural numbers are those numbers that are not ordered in a particular numbering scheme and are not human-generated or generated from a random number system. For example, most vendor invoice totals or listings of payment amounts will be populated by currency values that are natural numbers. Conversely, non-natural numbers (e.g., employee identification numbers and telephone numbers) are designed systematically to convey information that restricts the natural nature of the number. Any number that is arbitrarily determined, such as the price of inventory held for sale, is considered a non-natural number.

Question 67

Why do fraud examiners perform textual analytics?

A. To reveal patterns, sentiments, and relationships that are indicative of fraud
B. To uncover warning signs of potentially fraudulent employee behavior
C. To gauge the pressures/incentives, opportunities, and rationalizations to commit fraud
D. All of the above

Answer 67

D. All of the above

See pages 3.739-3.740 in the Fraud Examiner’s Manual

Textual analytics is a method of using software to extract usable information from unstructured text data. Through the application of linguistic technologies and statistical techniques—including weighted fraud indicators (e.g., fraud keywords) and scoring algorithms—textual analytics software can categorize data to reveal patterns, sentiments, and relationships that are indicative of fraud. For example, an analysis of email communications might help fraud examiners to gauge the pressures/incentives, opportunities, and rationalizations to commit fraud that exist in an organization. Textual analytics provides the ability to uncover additional warning signs of potentially fraudulent employee behavior.

Depending on the type of fraud risk present in a fraud examiner’s investigation, they will want to create a list of fraud keywords that are likely to suggest suspicious activity. This list will depend on the industry, fraud schemes, and the data set the fraud examiner has available. In other words, if they are running a search through journal entry details, they will likely search for different fraud keywords than if they were running a search of emails. Additionally, it can be helpful to consider the three components identified in the Fraud Triangle when coming up with a keyword list.

Question 68

_____________ is a method of using software to extract usable information from unstructured data.

A. Textual analytics
B. The Fog Index
C. Linguistic analytics
D. Benford’s Law

Answer 68

A. Textual analytics

See pages 3.739 in the Fraud Examiner’s Manual

Textual analytics is a method of using software to extract usable information from unstructured text data. Through the application of linguistic technologies and statistical techniques—including weighted fraud indicators (e.g., fraud keywords) and scoring algorithms—textual analytics software can categorize data to reveal patterns, sentiments, and relationships that are indicative of fraud. For example, an analysis of email communications might help fraud examiners to gauge the pressures/incentives, opportunities, and rationalizations to commit fraud that exist in an organization.

Question 69

Understanding the structure and availability of existing data during a data analysis engagement helps to ensure that the fraud examiner can build workable tests to run on the data.

A. True
B. False

Answer 69

A. True

See pages 3.705-3.706 in the Fraud Examiner’s Manual

Although the purpose of data analysis involves running targeted tests on data to identify anomalies, the ability of such tests to help detect fraud depends greatly on what the fraud examiner does before and after performing the data analysis techniques. Without sufficient time and attention devoted to planning, the fraud examiner risks analyzing the data inefficiently, lacking focus or direction for the engagement, encountering avoidable technical difficulties, and possibly overlooking key areas for exploration.

As a first step in the planning process—before determining which tests to run—the fraud examiner must know what data are available to be analyzed and how those data are structured. Understanding the structure of the existing data will not only help ensure that the fraud examiner builds workable tests to be run on the data but might also help identify additional areas for exploration that might otherwise have been overlooked.

Question 70

Which of the following steps should a fraud examiner take prior to seizing evidence in a digital forensic investigation to ensure its admissibility?

A. Ensure that only trained professionals use any digital forensic tools.
B. Consider potential privacy issues related to the item(s) being searched.
C. Determine appropriate remote evidence collection procedures and legal considerations.
D. All of the above are steps that should be taken prior to seizing evidence.

Answer 70

D. All of the above are steps that should be taken prior to seizing evidence.

See pages 3.814-3.815 in the Fraud Examiner’s Manual

Before fraud examiners can seize evidence, they must take certain steps to help ensure that the evidence will be admissible. Such steps include determining whether there are any privacy interests in the item(s) to be searched, determining appropriate procedures for any remote evidence collection, making appropriate preparations if the investigation involves the use of a legal order, and ensuring that all equipment used in a forensic capacity is legitimate and reliable (e.g., only use licensed software applications, independently validate all forensic equipment and maintain the validation on file). In addition, fraud examiners must also ensure that only trained professionals use any digital forensic tools during an engagement and that the equipment is employed in the manner for which it was designed (e.g., know when to use write-blocking software prior to viewing data, confirm that imaging software was designed for use with the applicable operating system).

Question 71

Which of the following is typically the MOST EFFECTIVE way to document the chain of custody for a piece of evidence?

A. An affidavit signed by the fraud examiner swearing to the evidence’s contents
B. A video recording of the fraud examiner explaining the process used to collect the evidence
C. A memorandum created with the custodian of the evidence when the evidence is received
D. A photograph of the evidence that clearly shows what the evidence is and where it was originally found

Answer 71

C. A memorandum created with the custodian of the evidence when the evidence is received

See pages 3.207-3.208 in the Fraud Examiner’s Manual

From the moment evidence is received, its chain of custody must be maintained for it to be accepted by the court. The chain of custody is both a process and a document that memorializes who has had possession of an object and what they have done with it. Essentially, the chain of custody is a recordkeeping procedure similar to physical inventory procedures.

In general, to establish the chain of custody, fraud examiners must make a record of when they, or any other member of the fraud examination team, receive an item and when it leaves their care, custody, or control. This is best handled by creating a memorandum with the custodian of the records when the evidence is received. The memorandum should state:

• What items were received
• When they were received
• From whom they were received
• Where they are maintained

Question 72

On which of the following data fields would a fraud examiner be MOST LIKELY to run a duplicate test to search for a duplicate value?

A. Inventory counts
B. Account balances
C. Invoice numbers
D. Product numbers

Answer 72

C. Invoice numbers

See pages 3.719 in the Fraud Examiner’s Manual

Duplicate testing is used to identify transactions with duplicate values in specified fields. This technique can quickly review the file, or several files joined together, to highlight duplicate values of key fields. In many systems, the key fields should contain only unique values (no duplicate records).

For example, a fraud examiner would expect fields such as invoice numbers and government identification numbers to contain only unique values within a data set; searching for duplicates within these fields can help the fraud examiner find anomalies that merit further examination.

Question 73

Similar to traditional forensics, cloud forensics has step-by-step frameworks and specialist tools designed to operate within the cloud environment to enable fraud examiners the ability to locate and preserve data in the cloud.

A. True
B. False

Answer 73

B. False

See pages 3.830 in the Fraud Examiner’s Manual

Conducting digital forensic investigations in the cloud environment (i.e., cloud forensics) presents challenges not encountered in traditional forensic investigations. A lack of frameworks and specialist tools is one factor that complicates such investigations. Unlike traditional forensics, which have clear, step-by-step frameworks and specialist tools for the collection of evidence suitable for presentation in court, there are no such widely recognized frameworks or tools for collecting evidence in the cloud. In fact, many digital forensic tools are not designed to operate within the cloud environment, and tools and procedures for locating, isolating, and preserving data in the cloud are not standardized.

Question 74

Memoranda, canceled checks, invoices, and receipts are all examples of which of the following types of evidence?

A. Digital evidence
B. Testimonial evidence
C. Documentary evidence
D. Relevant evidence

Answer 74

C. Documentary evidence

See pages 3.201 in the Fraud Examiner’s Manual

Documentary evidence consists of records that help prove or disprove the existence of fraud or another relevant fact of a case. These records might be created or maintained by the individuals or organizations to whom they pertain or by a third party, such as a vendor or financial institution. Among the most common types of documentary evidence in fraud examinations are canceled checks, memoranda, invoices, ledgers, letters, minutes of meetings, receipts, and financial records, such as bank statements.

Question 75

Fraud examiners should take which of the following steps when securing a computer to help ensure that the machine can be fully analyzed?

A. Implement a system to manage the evidence
B. Inspect the machine for traps
C. Examine and document the machine’s surroundings
D. All of the above

Answer 75

D. All of the above

See pages 3.817 in the Fraud Examiner’s Manual

To ensure that a machine can be fully analyzed, the fraud examiner should adhere to the following practices:

1. Examine and document the machine’s surroundings.
2. Inspect for traps.
3. If the computer is off, leave it off.
4. Consider collecting volatile data “live.”
5. Secure the evidence.
6. Image the system hard drives.
7. Document the collection process.
8. Implement a system to manage the evidence.

Question 76

Which of the following is TRUE regarding textual analytics?

A. There is a universal list of fraud keywords to use when implementing textual analytics that is applicable to any fraud examination.
B. The purpose of performing textual analytics is to find and extract an admission of fraud that can be presented in court.
C. Textual analytics is used to determine whether someone is lying or telling the truth based on clues within the data.
D. Textual analytics can be used to categorize data to reveal patterns, sentiments, and relationships that are indicative of fraud.

Answer 76

D. Textual analytics can be used to categorize data to reveal patterns, sentiments, and relationships that are indicative of fraud.

See pages 3.739-3.740 in the Fraud Examiner’s Manual

Textual analytics is a method of using software to extract usable information from unstructured text data. Through the application of linguistic technologies and statistical techniques—including weighted fraud indicators (e.g., fraud keywords) and scoring algorithms—textual analytics software can categorize data to reveal patterns, sentiments, and relationships that are indicative of fraud. For example, an analysis of email communications might help fraud examiners to gauge the pressures/incentives, opportunities, and rationalizations to commit fraud that exist in an organization. Textual analytics provides the ability to uncover additional warning signs of potentially fraudulent employee behavior.

Depending on the type of fraud risk present in a fraud examiner’s investigation, they will want to create a list of fraud keywords that are likely to suggest suspicious activity. This list will depend on the industry, fraud schemes, and the data set the fraud examiner has available. In other words, if they are running a search through journal entry details, they will likely search for different fraud keywords than if they were running a search of emails. Additionally, it can be helpful to consider the three components identified in the Fraud Triangle when coming up with a keyword list.

Question 77

Digital forensic investigations in cloud environments can be complicated by the jurisdiction of storage, as cloud providers commonly store data in servers across multiple jurisdictions.

A. True
B. False

Answer 77

A. True

See pages 3.830, 3.832 in the Fraud Examiner’s Manual

Conducting digital forensic investigations in the cloud environment (i.e., cloud forensics) presents challenges not encountered in traditional forensic investigations, and the jurisdiction of storage is one factor that complicates such investigations.

Cloud providers commonly store data in servers in different locations around the world. Consequently, it is possible that evidence related to individuals within the same organization could be segregated in different physical locations, thus complicating a fraud examiner’s ability to determine jurisdiction. Because all jurisdictions impose different laws and regulations regarding the storage, use, and access of data, the collection of relevant data might be complicated by the distribution of servers among multiple jurisdictions.

Question 78

A fraud examiner is preparing for a data analysis engagement. Why might the fraud examiner cleanse and normalize data prior to testing it?

A. To ensure that the data can be analyzed consistently
B. To ensure that any known errors in the data are addressed
C. To ensure that the data are in a structured format
D. All of the above

Answer 78

D. All of the above

See pages 3.708-3.710 in the Fraud Examiner’s Manual

The results of a data analysis test will only be as good as the data used for the analysis. Before running tests on the data, the fraud examiner must make certain the data being analyzed are relevant and reliable for the objective of the engagement.

Depending on how the data were collected and processed, as well as the results of the data verification process, the fraud examiner might need to cleanse and convert the data to a format suitable for analysis before executing any data analysis tests. For example, certain field formats (e.g., date, time, or currency) might need to be modified to make the information consistent and ready for testing. The data must also be normalized so that all data being imported for analysis can be analyzed consistently. Common data fields from multiple systems must be identified, and data must be standardized. In normalizing the data for analysis, table layout, fields/records, data length, data format, and table relationships are all important considerations.

Additionally, the following inconsistencies in the data must be addressed:

• Known errors
• Special/unreadable characters in the data
• Other unusable entries

When possible, such situations should be addressed by fixing, isolating, or eliminating them. Any issues that cannot be cleaned up will require special consideration during the testing and interpretation phase.

Question 79

Which of the following is TRUE regarding the types of information that digital forensic experts can typically recover from computer systems?

A. Digital forensic experts can recover time and date information about files, such as when they were created or modified
B. Digital forensic experts can recover information about websites that were visited on the computer system
C. Digital forensic experts can recover deleted emails, link files, and documents
D. All of the above

Answer 79

D. All of the above

See pages 3.801-3.803 in the Fraud Examiner’s Manual

Digital forensics encompasses the recovery and investigation of data found in digital devices, and digital forensic experts are trained professionals who specialize in identifying, recovering, collecting, preserving, processing, and producing digital data for use in investigations and litigation.

Digital forensic experts are often able to recover evidence that a nonexpert cannot. For example, if the target of an investigation tried to delete electronic evidence, then an expert might be able to recover it. There are a variety of ways to recover deleted or hidden data from a target computer, and digital forensic experts are specially trained for such tasks. Deleted files, both those that have been purposely deleted and those that were accidentally deleted, are sometimes recoverable because data are not erased from a computer’s hard drive until the operating system overwrites all or some of the files. Digital forensic experts usually cannot recover deleted files that have been overwritten.

Digital forensic experts can recover, among other things, the following types of information from computers:

• Deleted files and other data that have not been overwritten (e.g., deleted documents, images, link or shortcut files, and email messages)
• Files deleted through computer-automated processes
• Temporary auto-save files
• Print-spool files
• Websites visited, even where the browser history and cache have been deleted
• Communications sent via email, chat, or instant message (IM)
• Financial-based internet transactions
• Documents, letters, and images created, modified, or accessed, even if the data were not saved on the computer
• Data that have been copied, corrupted, or moved
• Time and date information about files (e.g., when files were created, accessed, modified, installed, deleted, or downloaded)
• Data from a drive that has been defragmented or reformatted
• Hidden files

Question 80

Why would a fraud examiner perform duplicate testing on data?

A. To determine whether company policies are met by employee transactions
B. To identify transactions with matching values in the same field
C. To identify missing items in a sequence or series
D. To determine the relationship among different variables in raw data

Answer 80

B. To identify transactions with matching values in the same field

See pages 3.719 in the Fraud Examiner’s Manual

Duplicate testing is used to identify transactions with duplicate values in specified fields. This technique can quickly review the file, or several files joined together, to highlight duplicate values of key fields. In many systems, the key fields should contain only unique values (no duplicate records).

For example, a fraud examiner would expect fields such as invoice numbers and government identification numbers to contain only unique values within a data set; searching for duplicates within these fields can help the fraud examiner find anomalies that merit further examination.

Question 81

Which of the following is TRUE about using computer-created metadata in digital forensic investigations?

A. Metadata can help determine who edited or made changes to a document
B. Metadata can help determine when a document was copied and moved
C. Metadata can help determine who created or accessed a document
D. All of the above

Answer 81

D. All of the above

See pages 3.810 in the Fraud Examiner’s Manual

Metadata is a type of computer-generated data that can be helpful in a fraud investigation. Metadata is data about data, and these files contain a tremendous amount of information. Metadata can help determine who wrote a document; who received, opened, copied, edited, moved, or printed the document; and when these events occurred.

Question 82

Lee manages a house painting company. He notices expenses have increased substantially from the prior year, which is unexpected because the company had much less business this year and painted fewer houses. Which of the following data analysis functions would be the MOST USEFUL in helping Lee determine the relationship between expense and houses painted?

A. Benford’s Law analysis
B. Correlation analysis
C. Verifying multiples of a number
D. Stratification

Answer 82

B. Correlation analysis

See pages 3.717 in the Fraud Examiner’s Manual

By using the correlation analysis function, fraud examiners can determine the relationships among different variables in the raw data. Fraud examiners can learn a lot about data files by learning the relationship between two variables. For example, one should expect a strong correlation between the following independent and dependent variables because a direct relationship exists between the two variables. Hotel costs should increase as the number of days traveled increases. Gallons of paint used should increase as the number of houses painted increases.

Question 83

When conducting a data analysis engagement to detect fraud, it is important to build a profile of potential frauds before identifying, obtaining, and analyzing the data.

A. True
B. False

Answer 83

A. True

See pages 3.707-3.708 in the Fraud Examiner’s Manual

To maximize the potential success of detecting fraud through data analysis, the analysis performed should be based on an understanding of the entity’s existing fraud risks. To do so, the fraud examiner must first build a profile of potential frauds by identifying the organization’s risk areas, the types of frauds possible in those risk areas, and the resulting exposure to those frauds.

Using the profile of potential frauds as a guide, the fraud examiner must identify the target data for analysis. Specifically, for each specific fraud scenario assessed to be a high risk to the organization, the fraud examiner should determine which data fields and records would be affected by such a scheme. The fraud examiner must then identify the logistics involved with obtaining this information, including:

• What specific data (i.e., fields, records) are available
• Who generates and maintains the data
• Where the data are stored
• Timing of the data extraction (e.g., date range, cutoff dates/times)
• How the fraud examiner will receive and store the data (i.e., data format and storage/transfer mechanism)
• Control totals needed for verification
• How to validate the sources of data

Question 84

Text-based data are typically considered:

A. Unstructured data
B. Structured data
C. Narrative data
D. Documentary data

Answer 84

A. Unstructured data

See pages 3.738 in the Fraud Examiner’s Manual

Data are either structured or unstructured. Structured data are the type of data found in a database, consisting of recognizable and predictable structures. Examples of structured data include sales records, payment or expense details, and financial reports. Unstructured data, by contrast, are data that would not be found in a traditional spreadsheet or database. They are typically text based.

Question 85

Even if files have been deleted from a target computer, it might be possible to recover those files.

A. True
B. False

Answer 85

A. True

See pages 3.802 in the Fraud Examiner’s Manual

There are a variety of ways to recover deleted or hidden data from a target computer, and digital forensic experts are specially trained for such tasks.

Deleted files, both those that have been purposely deleted and those that were accidentally deleted, are sometimes recoverable because data are not erased from a computer’s hard drive until the operating system overwrites all or some of the files.

Question 86

Which of the following computer event logs records events executed on an operating system, such as starting up and shutting down, configuration updates, and system crashes?

A. Security log
B. System log
C. Application log
D. None of the above

Answer 86

B. System log

See pages 3.810 in the Fraud Examiner’s Manual

Every operating system generates event logs, which are files that record events or transactions on a computer. In fact, a log entry is created for each event or transaction that takes place on any computer, and consequently, there are numerous types of event logs. Some common types of logs include system logs, application logs, and security logs. System logs record events executed on an operating system, including miscellaneous events and those generated during system start-up, such as hardware and controller failures. Common types of system events include starting up and shutting down, configuration updates, and system crashes. Application logs record the events regarding access to application data. Such events would include data files being opened or closed; specific actions such as reading, editing, deleting, or printing of application files; or the modification of records in an application file. Security logs track security-related events like log-on and log-off times and changes to access rights.

Question 87

Which of the following BEST describes the image acquisition process used in examinations involving digital evidence?

A. Analyzing the system’s data to identify evidence
B. Acquiring the digital evidence from the suspect
C. Creating an exact duplicate of the original storage media
D. Taking photos of the digital equipment’s physical layout and connections

Answer 87

C. Creating an exact duplicate of the original storage media

See pages 3.826 in the Fraud Examiner’s Manual

Once a computer system is seized and before any analysis occurs, it should be imaged for analysis. Forensic analysis should not be performed directly on suspect devices because doing so can alter or damage digital evidence. Imaging the data from suspect devices allows a fraud examiner to view and analyze a computer’s contents without altering the original data in any way.

Imaging refers to the process whereby a forensic image of a hard drive or other digital media is made and imaged to another hard disk drive or other media for forensic analysis. A forensic image (also called a forensic copy, mirror image, or ghost image) is a duplicate or exact copy of a hard drive or other digital media.

Question 88

Artificial intelligence refers to computer systems that perform human tasks, such as visual perception and decision-making.

A. True
B. False

Answer 88

A. True

See pages 3.726 in the Fraud Examiner’s Manual

Artificial intelligence refers to computer systems that perform human tasks, such as visual perception and decision-making.

Question 89

If you are seizing a computer for forensic analysis, it is generally unnecessary to seize printers connected to it.

A. True
B. False

Answer 89

B. False

See pages 3.811-3.812 in the Fraud Examiner’s Manual

Printers might contain valuable evidence. Many printers have internal hard drives that can contain information relevant to a fraud examination. In general, any information sent to and stored by a printer is recoverable unless the printer has overwritten the data. Therefore, when seizing a computer for forensic analysis, it is generally necessary to seize any printers connected to it.