ACFE Updated CFE-Investigation Exam Questions and Answers by colby

Digital forensics guidance stresses:

If the computer isoff,do not turn it on, because booting will alter files and timestamps.

If the computer isonand volatile data is needed (e.g., RAM), a formally trained examiner may collect it live. Otherwise, simply unplugging the system (hard shutdown) preserves volatile evidence better than a graceful shutdown.

Thus, if the evidence exists only in volatile data and the system is running, Nobles may collect it via the normal interface.

✅Answer: A. If Lucas's computer is running, Nobles may retrieve data… if the evidence exists only in volatile data

Guidance on reports:

“A fraud examination report should be accurate, clear, and impartial. The fraud examiner should avoid technical jargon where possible and write in plain language so that readers without specialized knowledge can understand”.

Reports should only include relevant, factual findings—not every detail or opinion.

So, the most accurate statement is that jargon should be avoided.

“Before commencing a formal investigation (and especially before starting the evidence collection process), it might be necessary to prepare the subject organisation… such as preparing the managers of the employees who will be involved in the investigation, notifying key decision makers, and notifying the organisation’s legal counsel”.

It is not good practice to notify the entire workforce or inform the suspect.

The manual emphasizes that interviews—especially with subjects in other jurisdictions—poselegal and cultural considerations. Fraud examiners must considercultural norms (such as personal space, body language, and eye contact) and jurisdiction-specific lawsgoverning the use of information from interviews. In particular, some jurisdictions limit how interview information can later be used. Therefore, the most accurate statement is that the examiner should verify such limitations before proceeding.